deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-10995
Published: 2017-07-07
Description: The mng_get_long function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/99496; https://github.com/ImageMagick/ImageMagick/issues/538; https://usn.ubuntu.com/3681-1/
CVE: CVE-2014-7953
Published: 2017-07-07
Description: Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat's output looking for a dexopt line, which once found should execute bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://seclists.org/fulldisclosure/2015/Apr/52; http://www.securityfocus.com/archive/1/535296/100/1100/threaded; http://www.securityfocus.com/bid/74213
CVE: CVE-2014-7954
Published: 2017-07-07
Description: Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically proximate attackers with a direct connection to the target Android device to upload files outside of the sdcard via a .. (dot dot) in a name parameter of an MTP request.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/131509/Android-4.4-MTP-Path-Traversal.html; http://seclists.org/fulldisclosure/2015/Apr/50; http://www.securityfocus.com/archive/1/535294/100/1100/threaded
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-07
Description: systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2017/07/02/1; http://www.securityfocus.com/bid/99507; http://www.securitytracker.com/id/1038839
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-07
Description: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99148; https://c-ares.haxx.se/0616.patch; https://c-ares.haxx.se/adv_20170620.html
CVE: CVE-2017-6868
Published: 2017-07-07
Description: An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process (CP) of the RNA series module, if network access to Port 102/TCP is available and the configuration file for the CP is stored on the RNA's CPU.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/99234; http://www.securitytracker.com/id/1038788; https://ics-cert.us-cert.gov/advisories/ICSA-17-173-01
CVE: CVE-2017-9627
Published: 2017-07-07
Description: An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2[PII_REDACTED].1 and prior. The uncontrolled resource consumption vulnerability could allow an attacker to exhaust the memory resources of the machine, causing a denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-400
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116/; http://www.securityfocus.com/bid/99488; http://www.securitytracker.com/id/1038836
CVE: CVE-2017-9629
Published: 2017-07-07
Description: A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2[PII_REDACTED].1 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116/; http://www.securityfocus.com/bid/99488; http://www.securitytracker.com/id/1038836
CVE: CVE-2017-9631
Published: 2017-07-07
Description: A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2[PII_REDACTED].1 and prior. The null pointer dereference vulnerability could allow an attacker to crash the logger process, causing a denial of service for logging and log-viewing (applications that use the Wonderware ArchestrA Logger continue to run when the Wonderware ArchestrA Logger service is unavailable).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116/; http://www.securityfocus.com/bid/99488; http://www.securitytracker.com/id/1038836
CVE: CVE-2017-11096
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/25; https://github.com/matthiaskramm/swftools/issues/25
CVE: CVE-2017-11097
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/24; https://github.com/matthiaskramm/swftools/issues/24
CVE: CVE-2017-11098
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in png2swf, it can lead to a Segmentation Violation in the png_load() function in lib/png.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/matthiaskramm/swftools/issues/32; https://github.com/matthiaskramm/swftools/issues/32
CVE: CVE-2017-11099
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in wav2swf, it can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/matthiaskramm/swftools/issues/31; https://github.com/matthiaskramm/swftools/issues/31
CVE: CVE-2017-11100
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in swfextract, it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in lib/rxfswf.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/27; https://github.com/matthiaskramm/swftools/issues/27
CVE: CVE-2017-11101
Published: 2017-07-07
Description: When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/26; https://github.com/matthiaskramm/swftools/issues/26
CVE: CVE-2017-11102
Published: 2017-07-07
Description: The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length color_image data structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/d445af60a8d5; http://hg.code.sf.net/p/graphicsmagick/code/rev/dea93a690fc1; http://www.securityfocus.com/bid/99498
CVE: CVE-2017-7660
Published: 2017-07-07
Description: Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3E; http://www.securityfocus.com/bid/99485; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-8442
Published: 2017-07-07
Description: Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-402, CWE-200
References: https://www.elastic.co/community/security; https://www.elastic.co/community/security
CVE: CVE-2017-7512
Published: 2017-07-07
Description: Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://access.redhat.com/errata/RHSA-2017:1712; https://access.redhat.com/security/cve/cve-2017-7512; https://bugzilla.redhat.com/show_bug.cgi?id=1457997
CVE: CVE-2017-11104
Published: 2017-07-08
Description: Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00076.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00089.html
CVE: CVE-2017-11107
Published: 2017-07-08
Description: phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1701731; https://github.com/leenooks/phpLDAPadmin/issues/50; https://lists.debian.org/debian-lts-announce/2018/10/msg00023.html
CVE: CVE-2017-11108
Published: 2017-07-08
Description: tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3971; https://access.redhat.com/errata/RHEA-2018:0705; https://bugzilla.redhat.com/show_bug.cgi?id=1468504
CVE: CVE-2017-11109
Published: 2017-07-08
Description: Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1468492; https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html; https://usn.ubuntu.com/4309-1/
CVE: CVE-2017-11110
Published: 2017-07-08
Description: The ole_init function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service (heap-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted file, i.e., data is written to memory addresses before the beginning of the tmpBuf buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1468471; https://bugzilla.redhat.com/show_bug.cgi?id=1468471
CVE: CVE-2017-11111
Published: 2017-07-08
Description: In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392415; https://security.gentoo.org/glsa/201903-19; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-11112
Published: 2017-07-08
Description: In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1464686; https://security.gentoo.org/glsa/201804-13; https://bugzilla.redhat.com/show_bug.cgi?id=1464686
CVE: CVE-2017-11113
Published: 2017-07-08
Description: In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1464691; https://security.gentoo.org/glsa/201804-13; https://bugzilla.redhat.com/show_bug.cgi?id=1464691
CVE: CVE-2017-4976
Published: 2017-07-09
Description: EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2017/Jul/13; http://www.securitytracker.com/id/1038840; http://seclists.org/fulldisclosure/2017/Jul/13
CVE: CVE-2017-8002
Published: 2017-07-09
Description: EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentially exploit these vulnerabilities to gain information about the application by causing execution of arbitrary SQL commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Jul/12; http://www.securityfocus.com/bid/99487; http://www.securitytracker.com/id/1038841
CVE: CVE-2017-8003
Published: 2017-07-09
Description: EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2017/Jul/12; http://www.securityfocus.com/bid/99487; http://www.securitytracker.com/id/1038841
CVE: CVE-2017-11124
Published: 2017-07-10
Description: libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/06/28/xar-null-pointer-dereference-in-xar_unserialize-archive-c/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC/
CVE: CVE-2017-11125
Published: 2017-07-10
Description: libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/06/28/xar-null-pointer-dereference-in-xar_get_path-util-c/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC/
CVE: CVE-2017-11126
Published: 2017-07-10
Description: The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://openwall.com/lists/oss-security/2017/07/10/4; https://blogs.gentoo.org/ago/2017/07/03/mpg123-global-buffer-overflow-in-iii_i_stereo-layer3-c/; http://openwall.com/lists/oss-security/2017/07/10/4
CVE: CVE-2017-11139
Published: 2017-07-10
Description: GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/4d0baa77245b; http://www.securityfocus.com/bid/99504; https://www.debian.org/security/2018/dsa-4321
CVE: CVE-2017-11140
Published: 2017-07-10
Description: The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-755
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/b4139088b49a; http://www.securityfocus.com/bid/99503; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-11141
Published: 2017-07-10
Description: The ReadMATImage function in coders\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/99506; https://github.com/ImageMagick/ImageMagick/issues/469; http://www.securityfocus.com/bid/99506
CVE: CVE-2016-10397
Published: 2017-07-10
Description: In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4; http://openwall.com/lists/oss-security/2017/07/10/6; http://php.net/ChangeLog-5.php
CVE: CVE-2017-11142
Published: 2017-07-10
Description: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://openwall.com/lists/oss-security/2017/07/10/6; http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php
CVE: CVE-2017-11143
Published: 2017-07-10
Description: In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-502
References: http://openwall.com/lists/oss-security/2017/07/10/6; http://php.net/ChangeLog-5.php; http://www.securityfocus.com/bid/99553
CVE: CVE-2017-11144
Published: 2017-07-10
Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3
CVE: CVE-2017-11145
Published: 2017-07-10
Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e8b7698f5ee757ce2c8bd10a192a491a498f891c; http://openwall.com/lists/oss-security/2017/07/10/6; http://php.net/ChangeLog-5.php
CVE: CVE-2017-11146
Published: 2017-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145.  Notes: none
CVE: CVE-2017-11147
Published: 2017-07-10
Description: In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451; http://openwall.com/lists/oss-security/2017/07/10/6; http://php.net/ChangeLog-5.php
CVE: CVE-2017-1284
Published: 2017-07-10
Description: IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSphere Application Server traces including user credentials. IBM X-Force ID: 125145.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22003851; http://www.securityfocus.com/bid/99494; https://exchange.xforce.ibmcloud.com/vulnerabilities/125145
CVE: CVE-2017-1337
Published: 2017-07-10
Description: IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22003853; http://www.securityfocus.com/bid/99493; https://exchange.xforce.ibmcloud.com/vulnerabilities/126245
CVE: CVE-2017-1398
Published: 2017-07-10
Description: IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22005360; http://www.securityfocus.com/bid/99491; https://exchange.xforce.ibmcloud.com/vulnerabilities/127385