deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2997
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96860; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-2998
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96866; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-2999
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96866; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-3000
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96862; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-3001
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to garbage collection in the ActionScript 2 VM. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96861; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-3002
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability in the ActionScript2 TextField object related to the variable property. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96861; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-3003
Published: 2017-03-14
Description: Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to an interaction between the privacy user interface and the ActionScript 2 Camera object. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96861; http://www.securitytracker.com/id/1037994
CVE: CVE-2017-5985
Published: 2017-03-14
Description: lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check.
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html; http://www.openwall.com/lists/oss-security/2017/03/09/4; http://www.securityfocus.com/bid/96777
CVE: CVE-2017-6516
Published: 2017-03-14
Description: A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.magnicomp.com/support/cve/CVE-2017-6516.shtml; http://www.securityfocus.com/bid/96934; https://labs.mwrinfosecurity.com/advisories/magnicomps-sysinfo-root-setuid-local-privilege-escalation-vulnerability/
CVE: CVE-2017-6896
Published: 2017-03-14
Description: Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-565
References: http://seclists.org/fulldisclosure/2017/Mar/52; https://drive.google.com/file/d/0B6715xUqH18MX29uRlpaSVJ4OTA/view?usp=sharing; https://packetstormsecurity.com/files/141693/digisol-escalate.txt
CVE: CVE-2017-6902
Published: 2017-03-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-7460
Published: 2017-03-14
Description: A write protection and execution bypass vulnerability in McAfee (now Intel Security) Application Control (MAC) 6.1.0 for Linux and earlier allows authenticated users to change binaries that are part of the Application Control whitelist and allows execution of binaries via specific conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10054; https://kc.mcafee.com/corporate/index?page=content&id=SB10054
CVE: CVE-2013-7461
Published: 2017-03-14
Description: A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated users to change files that are part of write protection rules via specific conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10054; https://kc.mcafee.com/corporate/index?page=content&id=SB10054
CVE: CVE-2013-7462
Published: 2017-03-14
Description: A directory traversal vulnerability in the web application in McAfee (now Intel Security) SaaS Control Console (SCC) Platform 6.14 before patch 1070, and 6.15 before patch 1076 allows unauthenticated users to view contents of arbitrary system files that did not have file system level read access restrictions via a null-byte injection exploit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10056; https://kc.mcafee.com/corporate/index?page=content&id=SB10056
CVE: CVE-2014-9920
Published: 2017-03-14
Description: Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 9068, 6.1.0 before hotfix 692, 6.1.1 before hotfix 399, 6.1.2 before hotfix 426, and 6.1.3 before hotfix 357 and earlier allows attackers to create a malformed Windows binary that is considered non-executable and is not protected through the whitelisting protection feature via a specific set of circumstances.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10077; https://kc.mcafee.com/corporate/index?page=content&id=SB10077
CVE: CVE-2014-9921
Published: 2017-03-14
Description: Information disclosure vulnerability in McAfee (now Intel Security) Cloud Analysis and Deconstructive Services (CADS) 1.0.0.3x, 1.0.0.4d and earlier allows remote unauthenticated users to view, add, and remove users via a configuration error.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10087; https://kc.mcafee.com/corporate/index?page=content&id=SB10087
CVE: CVE-2015-8986
Published: 2017-03-14
Description: Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-254
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10096; https://kc.mcafee.com/corporate/index?page=content&id=SB10096
CVE: CVE-2015-8987
Published: 2017-03-14
Description: Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make a McAfee Agent talk with another, possibly rogue, ePO server via McAfee Agent migration to another ePO server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10101; https://kc.mcafee.com/corporate/index?page=content&id=SB10101
CVE: CVE-2015-8988
Published: 2017-03-14
Description: Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10115; https://kc.mcafee.com/corporate/index?page=content&id=SB10115
CVE: CVE-2015-8989
Published: 2017-03-14
Description: Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-310
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10117; https://kc.mcafee.com/corporate/index?page=content&id=SB10117
CVE: CVE-2015-8990
Published: 2017-03-14
Description: Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10127; https://kc.mcafee.com/corporate/index?page=content&id=SB10127
CVE: CVE-2015-8991
Published: 2017-03-14
Description: Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462
CVE: CVE-2015-8992
Published: 2017-03-14
Description: Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462
CVE: CVE-2015-8993
Published: 2017-03-14
Description: Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102462
CVE: CVE-2016-10252
Published: 2017-03-14
Description: Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://git.imagemagick.org/repos/ImageMagick/commit/6790815c75bdea0357df[PII_REDACTED]856e995d6b; http://www.debian.org/security/2017/dsa-3808; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857426
CVE: CVE-2016-8005
Published: 2017-03-14
Description: File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10161; https://kc.mcafee.com/corporate/index?page=content&id=SB10161
CVE: CVE-2016-8007
Published: 2017-03-14
Description: Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/93813; https://kc.mcafee.com/corporate/index?page=content&id=SB10173; http://www.securityfocus.com/bid/93813
CVE: CVE-2016-8008
Published: 2017-03-14
Description: Privilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus (SSP) 3.11.376 allows attackers to load a replacement of the version.dll file via McAfee McUICnt.exe onto a Windows system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102593; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102593
CVE: CVE-2016-8009
Published: 2017-03-14
Description: Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10175; https://kc.mcafee.com/corporate/index?page=content&id=SB10175
CVE: CVE-2016-8010
Published: 2017-03-14
Description: Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94661; https://kc.mcafee.com/corporate/index?page=content&id=SB10179; http://www.securityfocus.com/bid/94661
CVE: CVE-2016-8011
Published: 2017-03-14
Description: Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10180; https://kc.mcafee.com/corporate/index?page=content&id=SB10180
CVE: CVE-2016-8012
Published: 2017-03-14
Description: Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10185; https://kc.mcafee.com/corporate/index?page=content&id=SB10185
CVE: CVE-2016-8016
Published: 2017-03-14
Description: Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
CVSS Score: 3.4 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8017
Published: 2017-03-14
Description: Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8018
Published: 2017-03-14
Description: Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8019
Published: 2017-03-14
Description: Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8020
Published: 2017-03-14
Description: Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8021
Published: 2017-03-14
Description: Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-347
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8022
Published: 2017-03-14
Description: Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8023
Published: 2017-03-14
Description: Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8024
Published: 2017-03-14
Description: Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-113
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8025
Published: 2017-03-14
Description: SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/94823; http://www.securitytracker.com/id/1037433; https://kc.mcafee.com/corporate/index?page=content&id=SB10181
CVE: CVE-2016-8026
Published: 2017-03-14
Description: Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98068; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102614; http://www.securityfocus.com/bid/98068
CVE: CVE-2016-8027
Published: 2017-03-14
Description: SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95981; http://www.securitytracker.com/id/1037777; https://kc.mcafee.com/corporate/index?page=content&id=SB10187
CVE: CVE-2017-3899
Published: 2017-03-14
Description: SQL injection vulnerability in Intel Security Advanced Threat Defense (ATD) Linux 3.6.0 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96929; https://kc.mcafee.com/corporate/index?page=content&id=SB10189; http://www.securityfocus.com/bid/96929
CVE: CVE-2017-6903
Published: 2017-03-14
Description: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
CVSS Score: 7.8 (HIGH)
References: http://www.debian.org/security/2017/dsa-3812; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857699; https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7
CVE: CVE-2017-6905
Published: 2017-03-15
Description: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96891; https://github.com/Mnkras/concrete5/commit/3eab581ab670982676e9dabddc9ad439391174ee; https://github.com/concrete5/concrete5-legacy/commit/2b16399ce3e962a8c27fb3ec14bc8e855d65b63a
CVE: CVE-2017-6906
Published: 2017-03-15
Description: An issue was discovered in SiberianCMS before 4.10.0.  The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "SiberianCMS-master/errors/500.php" URL.  An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96898; https://github.com/Xtraball/SiberianCMS/issues/217; http://www.securityfocus.com/bid/96898