deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15235
Published: 2017-10-11
Description: The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://blogs.securiteam.com/index.php/archives/3454; https://lists.debian.org/debian-lts-announce/2020/08/msg00050.html; https://blogs.securiteam.com/index.php/archives/3454
CVE: CVE-2017-15236
Published: 2017-10-11
Description: Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a crafted request to TCP port 3001, as demonstrated by config* files and extendword.txt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blogs.securiteam.com/index.php/archives/3444; https://blogs.securiteam.com/index.php/archives/3444
CVE: CVE-2017-15238
Published: 2017-10-11
Description: ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=93bdb9b30076; http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=df946910910d; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
CVE: CVE-2017-7352
Published: 2017-10-11
Description: Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System > Configuration > SNMP > Add SNMP Trap Manager' screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://arthrocyber.com/research#finding_3; http://arthrocyber.com/research#finding_3
CVE: CVE-2013-6924
Published: 2017-10-11
Description: Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/124688/Seagate-BlackArmor-NAS-sg2000-2000.1331-Remote-Command-Execution.html; http://www.securityfocus.com/bid/64655; https://exchange.xforce.ibmcloud.com/vulnerabilities/90109
CVE: CVE-2017-15220
Published: 2017-10-11
Description: Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42973/; https://www.exploit-db.com/exploits/42973/
CVE: CVE-2017-12188
Published: 2017-10-11
Description: arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun."
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-22
References: http://www.securityfocus.com/bid/101267; https://access.redhat.com/errata/RHSA-2018:0395; https://access.redhat.com/errata/RHSA-2018:0412
CVE: CVE-2017-13720
Published: 2017-10-11
Description: In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3995; https://bugzilla.redhat.com/show_bug.cgi?id=1500690; https://bugzilla.suse.com/show_bug.cgi?id=1054285
CVE: CVE-2017-13722
Published: 2017-10-11
Description: In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3995; https://bugzilla.redhat.com/show_bug.cgi?id=1500693; https://bugzilla.suse.com/show_bug.cgi?id=1049692
CVE: CVE-2017-15266
Published: 2017-10-11
Description: In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00002.html; http://openwall.com/lists/oss-security/2017/10/11/1; http://www.securityfocus.com/bid/101271
CVE: CVE-2017-15267
Published: 2017-10-11
Description: In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00003.html; http://openwall.com/lists/oss-security/2017/10/11/1; http://www.securityfocus.com/bid/101272
CVE: CVE-2017-0903
Published: 2017-10-11
Description: RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://blog.rubygems.org/2017/10/09/2.6.14-released.html; http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html; http://www.securityfocus.com/bid/101275
CVE: CVE-2017-14587
Published: 2017-10-11
Description: The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101266; https://jira.atlassian.com/browse/CRUC-8112; https://jira.atlassian.com/browse/FE-6933
CVE: CVE-2017-14588
Published: 2017-10-11
Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101268; https://jira.atlassian.com/browse/CRUC-8113; https://jira.atlassian.com/browse/FE-6935
CVE: CVE-2017-15083
Published: 2017-10-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1642.  Reason: This candidate is a reservation duplicate of CVE-2009-1642.2.  Notes: All CVE users should reference CVE-2009-1642 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-15239
Published: 2017-10-11
Description: IrfanView 4.44 - 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address may be used as a return value starting at PDF!xmlParserInputRead+0x[PII_REDACTED]040db4."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15239; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15239
CVE: CVE-2017-15240
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x[PII_REDACTED]132cef."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15240; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15240
CVE: CVE-2017-15241
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlParserInputRead+0x[PII_REDACTED]0929f5."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15241; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15241
CVE: CVE-2017-15242
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "User Mode Write AV starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]031abe."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15242; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15242
CVE: CVE-2017-15243
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Possible Stack Corruption starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]0568a4."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15243; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15243
CVE: CVE-2017-15244
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to an "Error Code (0xe06d7363) starting at wow64!Wow64NotifyDebugger+0x[PII_REDACTED]00001d."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15244; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15244
CVE: CVE-2017-15245
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]057b76."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15245; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15245
CVE: CVE-2017-15246
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "Read Access Violation on Block Data Move starting at PDF!xmlListWalk+0x[PII_REDACTED]01515b."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15246; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15246
CVE: CVE-2017-15247
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlParserInputRead+0x[PII_REDACTED]1168a1."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15247; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15247
CVE: CVE-2017-15248
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]063ca6."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15248; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15248
CVE: CVE-2017-15249
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]0668d6."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15249; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15249
CVE: CVE-2017-15250
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x[PII_REDACTED]132e19."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15250; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15250
CVE: CVE-2017-15251
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlParserInputRead+0x[PII_REDACTED]0e7326."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15251; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15251
CVE: CVE-2017-15252
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "Read Access Violation on Block Data Move starting at PDF!xmlListWalk+0x[PII_REDACTED]0158cb."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15252; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15252
CVE: CVE-2017-15253
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "User Mode Write AV starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]07dff2."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15253; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15253
CVE: CVE-2017-15254
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]07dfa5."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15254; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15254
CVE: CVE-2017-15255
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x[PII_REDACTED]1601b0."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15255; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15255
CVE: CVE-2017-15256
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlListWalk+0x[PII_REDACTED]019fc8."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15256; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15256
CVE: CVE-2017-15257
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlParserInputRead+0x[PII_REDACTED]09174a."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15257; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15257
CVE: CVE-2017-15258
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x[PII_REDACTED]161a9c."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15258; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15258
CVE: CVE-2017-15259
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlParserInputRead+0x[PII_REDACTED]11624a."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15259; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15259
CVE: CVE-2017-15260
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address may be used as a return value starting at PDF!xmlParserInputRead+0x[PII_REDACTED]129a59."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15260; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15260
CVE: CVE-2017-15261
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Possible Stack Corruption starting at PDF!xmlGetGlobalState+0x[PII_REDACTED]057b35."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15261; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15261
CVE: CVE-2017-15262
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at PDF!xmlParserInputRead+0x[PII_REDACTED]048d0c."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15262; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15262
CVE: CVE-2017-15263
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlListWalk+0x[PII_REDACTED]0166c4."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15263; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15263
CVE: CVE-2017-15264
Published: 2017-10-11
Description: IrfanView version 4.44 (32bit) allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at image00000000_00400000+0x[PII_REDACTED]0236e4."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15264; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15264
CVE: CVE-2017-2887
Published: 2017-10-11
Description: An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/101215; https://www.debian.org/security/2018/dsa-4177; https://www.debian.org/security/2018/dsa-4184
CVE: CVE-2017-2888
Published: 2017-10-11
Description: An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/101215; https://lists.debian.org/debian-lts-announce/2021/10/msg00031.html; https://usn.ubuntu.com/4143-1/
CVE: CVE-2017-14003
Published: 2017-10-11
Description: An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass authentication by accessing a specific uniform resource locator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-287
References: http://www.securityfocus.com/bid/101226; https://ics-cert.us-cert.gov/advisories/ICSA-17-283-01; http://www.securityfocus.com/bid/101226
CVE: CVE-2017-14369
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vulnerability to elevate their privileges and export certain application records.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securityfocus.com/bid/101195; http://www.securitytracker.com/id/1039518
CVE: CVE-2017-14370
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securitytracker.com/id/1039518; http://seclists.org/fulldisclosure/2017/Oct/12
CVE: CVE-2017-14371
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securityfocus.com/bid/101195; http://www.securitytracker.com/id/1039518