deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9791
Published: 2017-07-10
Description: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://struts.apache.org/docs/s2-048.html; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/99484
CVE: CVE-2017-11163
Published: 2017-07-10
Description: Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1038908; https://github.com/Cacti/cacti/issues/847; http://www.securitytracker.com/id/1038908
CVE: CVE-2017-11166
Published: 2017-07-10
Description: The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/471; https://github.com/ImageMagick/ImageMagick/issues/471
CVE: CVE-2017-7670
Published: 2017-07-10
Description: The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://lists.apache.org/thread.html/42b207e9f526353b504591684bd02a5e9fcb4b8f28534253d07740a0%40%3Cusers.trafficcontrol.apache.org%3E; https://lists.apache.org/thread.html/bb09fc29e9c2ee85b118a3d5748a8a523d30cf691ff8b606c6a1748c%40%3Ccommits.trafficcontrol.apache.org%3E; https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c[PII_REDACTED]dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E
CVE: CVE-2017-7175
Published: 2017-07-10
Description: NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Custom output format" field).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://sourceforge.net/p/nfsen/news/2017/01/nfsen-138-released---security-fix/; https://www.exploit-db.com/exploits/42314/; https://sourceforge.net/p/nfsen/news/2017/01/nfsen-138-released---security-fix/
CVE: CVE-2017-5640
Published: 2017-07-10
Description: It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not). If the malicious server responds with 'COMPLETE' before the SASL handshake has completed, the client will consider the handshake as completed even though no exchange of credentials has happened.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/99508; https://lists.apache.org/thread.html/c02e83aa46c90b7cbc87dd649cf8f9b73e11053eddea9144a397da53%40%3Cdev.impala.apache.org%3E; http://www.securityfocus.com/bid/99508
CVE: CVE-2017-5652
Published: 2017-07-10
Description: During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift transport when TLS was turned on. It was therefore possible for an adversary, with access to the network, to eavesdrop on the packets going to and coming from that port and view the data in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://www.securityfocus.com/archive/1/540831/100/0/threaded; https://lists.apache.org/thread.html/5bab4424f23aebefc8108a0e30273c2a543a289df8113c461f930143%40%3Cdev.impala.apache.org%3E; http://www.securityfocus.com/archive/1/540831/100/0/threaded
CVE: CVE-2017-6726
Published: 2017-07-10
Description: A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process information, which could lead to the disclosure of confidential information. More Information: CSCvd59341. Known Affected Releases: 4.2(1.0)P1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99456; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-cpn; http://www.securityfocus.com/bid/99456
CVE: CVE-2017-6727
Published: 2017-07-10
Description: A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device due to a process restarting unexpectedly and creating Core Dump files. More Information: CSCvc63035. Known Affected Releases: 6.2(3a). Known Fixed Releases: 6.3(0.167) 6.2(3c)5 6.2(3.22).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99483; http://www.securitytracker.com/id/1038824; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas
CVE: CVE-2017-6728
Published: 2017-07-10
Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system, because of Incorrect Permissions. More Information: CSCvb99389. Known Affected Releases: 6.2.1.BASE. Known Fixed Releases: 6.3.1.15i.BASE 6.2.3.1i.BASE 6.2.2.15i.BASE 6.1.4.10i.BASE.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/99464; http://www.securitytracker.com/id/1038821; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ios
CVE: CVE-2017-6729
Published: 2017-07-10
Description: A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core (VPC) Software could allow an unauthenticated, remote attacker to cause the BGP process on an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability affects the following products if they are running the Cisco StarOS operating system and BGP is enabled for the system: Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core Software. More Information: CSCvc44968. Known Affected Releases: 16.4.1 19.1.0 21.1.0 21.1.M0.65824. Known Fixed Releases: 21.3.A0.65902 21.2.A0.65905 21.1.b0.66164 21.1.V0.66014 21.1.R0.65898 21.1.M0.65894 21.1.0.66030 21.1.0.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/100015; http://www.securitytracker.com/id/1038819; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-staros
CVE: CVE-2017-6730
Published: 2017-07-10
Description: A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). Known Fixed Releases: 6.3(0.228) 6.3(0.226) 6.2(3d)8 5.5(7b)17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99481; http://www.securitytracker.com/id/1038825; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1
CVE: CVE-2017-6731
Published: 2017-07-10
Description: A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the MSDP session to be unexpectedly reset, causing a short denial of service (DoS) condition. The MSDP session will restart within a few seconds. More Information: CSCvd94828. Known Affected Releases: 4.3.2.MCAST 6.0.2.BASE. Known Fixed Releases: 6.3.1.19i.MCAST 6.2.3.1i.MCAST 6.2.2.17i.MCAST 6.1.4.12i.MCAST.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038820; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-iosxr; http://www.securitytracker.com/id/1038820
CVE: CVE-2017-6732
Published: 2017-07-10
Description: A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate their privileges to root privileges. More Information: CSCvd47343. Known Affected Releases: 4.2(2.1)PP1 4.2(3.0)PP6 4.3(0.0)PP4 4.3(1.0)PP2. Known Fixed Releases: 4.3(2).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/99457; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-prime; http://www.securityfocus.com/bid/99457
CVE: CVE-2017-6733
Published: 2017-07-10
Description: A vulnerability in the web-based application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvd87482. Known Affected Releases: 2.1(102.101) 2.2(0.283) 2.3(0.151).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99458; http://www.securitytracker.com/id/1038822; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise1
CVE: CVE-2017-6734
Published: 2017-07-10
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99459; http://www.securitytracker.com/id/1038823; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise2
CVE: CVE-2017-6735
Published: 2017-07-10
Description: A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99460; http://www.securitytracker.com/id/1038826; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-FireSIGHT
CVE: CVE-2017-8032
Published: 2017-07-10
Description: In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://www.cloudfoundry.org/cve-2017-8032/; https://www.cloudfoundry.org/cve-2017-8032/
CVE: CVE-2017-11164
Published: 2017-07-11
Description: In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://openwall.com/lists/oss-security/2017/07/11/3; http://www.openwall.com/lists/oss-security/2023/04/11/1; http://www.openwall.com/lists/oss-security/2023/04/12/1
CVE: CVE-2017-10600
Published: 2017-07-11
Description: ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://forum.snapcraft.io/t/ownership-bug-in-ubuntu-image/1285; https://forum.snapcraft.io/t/ownership-bug-in-ubuntu-image/1285
CVE: CVE-2017-7726
Published: 2017-07-11
Description: iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/; http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/
CVE: CVE-2017-7727
Published: 2017-07-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2017-7728
Published: 2017-07-11
Description: On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the alarm on/off), related to incorrect cryptography.
CVSS Score: 9.8 (CRITICAL)
References: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/; http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/
CVE: CVE-2017-7729
Published: 2017-07-11
Description: On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/; http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/
CVE: CVE-2017-7730
Published: 2017-07-11
Description: iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/; http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/
CVE: CVE-2017-11170
Published: 2017-07-11
Description: The ReadTGAImage function in coders\tga.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/99565; https://github.com/ImageMagick/ImageMagick/issues/472; http://www.securityfocus.com/bid/99565
CVE: CVE-2017-11171
Published: 2017-07-11
Description: Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.suse.com/show_bug.cgi?id=1025068; https://github.com/GNOME/gnome-session/commit/b0dc999e0b[PII_REDACTED]6321dbb6cb71e729fc9d; https://bugzilla.suse.com/show_bug.cgi?id=1025068
CVE: CVE-2017-0170
Published: 2017-07-11
Description: Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML input, aka "Windows Performance Monitor Information Disclosure Vulnerability".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/99398; http://www.securitytracker.com/id/1038855; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170
CVE: CVE-2017-0243
Published: 2017-07-11
Description: Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8570.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99446; http://www.securitytracker.com/id/1038851; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0243
CVE: CVE-2017-8463
Published: 2017-07-11
Description: Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it improperly handles executable files and shares during rename operations, aka "Windows Explorer Remote Code Execution Vulnerability".
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/99389; http://www.securitytracker.com/id/1038850; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8463
CVE: CVE-2017-8467
Published: 2017-07-11
Description: Graphics in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Win32k Elevation of Privilege Vulnerability".
CVSS Score: 7.0 (HIGH)
CWE: CWE-281
References: http://www.securityfocus.com/bid/99409; http://www.securitytracker.com/id/1038853; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8467
CVE: CVE-2017-8486
Published: 2017-07-11
Description: Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure due to the way it handles objects in memory, aka "Win32k Information Disclosure Vulnerability".
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99414; http://www.securitytracker.com/id/1038853; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8486
CVE: CVE-2017-8495
Published: 2017-07-11
Description: Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to bypass Extended Protection for Authentication when Kerberos fails to prevent tampering with the SNAME field during ticket exchange, aka "Kerberos SNAME Security Feature Bypass Vulnerability" or Orpheus' Lyre.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/99424; http://www.securitytracker.com/id/1038862; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8495
CVE: CVE-2017-8501
Published: 2017-07-11
Description: Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8502.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99441; http://www.securitytracker.com/id/1038851; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8501
CVE: CVE-2017-8502
Published: 2017-07-11
Description: Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8501.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99442; http://www.securitytracker.com/id/1038851; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8502
CVE: CVE-2017-8556
Published: 2017-07-11
Description: Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8573 and CVE-2017-8574.
CVSS Score: 7.0 (HIGH)
CWE: CWE-281
References: http://www.securityfocus.com/bid/99439; http://www.securitytracker.com/id/1038856; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8556
CVE: CVE-2017-8557
Published: 2017-07-11
Description: Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability improperly parses XML input containing a reference to an external entity, aka "Windows System Information Console Information Disclosure Vulnerability".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/99387; http://www.securityfocus.com/bid/99398; http://www.securitytracker.com/id/1038855
CVE: CVE-2017-8559
Published: 2017-07-11
Description: Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99448; http://www.securitytracker.com/id/1038852; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8559
CVE: CVE-2017-8560
Published: 2017-07-11
Description: Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8559.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99449; http://www.securitytracker.com/id/1038852; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8560