rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-15546 
The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database.
Problem types: description: SQL Injection Vulnerability
Affected products: vendor: n/a
product: EMC RSA Authentication Manager 8.2 SP1 P6 and earlier
Published: 2018-01-25T03:00:00.000Z
CVE-2017-15548 
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote unauthenticated malicious user can potentially bypass application authentication and gain unauthorized root access to the affected systems.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: n/a
product: EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0
Published: 2018-01-05T17:00:00.000Z
CVE-2017-15549 
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system.
Problem types: description: Arbitrary file upload vulnerability
Affected products: vendor: n/a
product: EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0
Published: 2018-01-05T17:00:00.000Z
CVE-2017-15550 
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal.
Problem types: description: Path traversal vulnerability
Affected products: vendor: n/a
product: EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0
Published: 2018-01-05T17:00:00.000Z
CVE-2017-15565 
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T22:00:00.000Z
CVE-2017-15566 
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T17:00:00.000Z
CVE-2017-15567 
The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors.  NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15568 
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15569 
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15570 
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15571 
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15572 
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15573 
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15574 
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15575 
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15576 
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15577 
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15578 
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15579 
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2017-15580 
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T08:00:00.000Z
CVE-2017-15581 
In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive information by sniffing the network during LoginActivity or NoteActivity execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T20:00:00.000Z
CVE-2017-15582 
In net.MCrypt in the "Diary with lock" (aka WriteDiary) application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T20:00:00.000Z
CVE-2017-15583 
The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that specifies a file for display or for use as a template. The filename is not validated; an attacker could retrieve any file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15587 
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15588 
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15589 
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15590 
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15591 
An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start to range end) within the DMOP map/unmap implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15592 
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15593 
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference counts are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15594 
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15595 
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15596 
An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T08:00:00.000Z
CVE-2017-15597 
An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2017-15600 
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T21:00:00.000Z
CVE-2017-15601 
In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T21:00:00.000Z
CVE-2017-15602 
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T21:00:00.000Z
CVE-2017-15607 
Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-01T08:00:00.000Z
CVE-2017-15608 
Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2017-15609 
Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T08:00:00.000Z
CVE-2017-15610 
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T08:00:00.000Z
CVE-2017-15611 
In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T08:00:00.000Z
CVE-2017-15612 
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T08:00:00.000Z
CVE-2017-15613 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15614 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15615 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15616 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the phddns.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15617 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interface_wan.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15618 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15619 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15620 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zone variable in the ipmac_import.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15621 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the olmode variable in the interface_wan.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15622 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15623 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15624 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15625 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15626 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15627 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15628 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15629 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15630 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15631 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15632 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15633 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the session_limits.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15634 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15635 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15636 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15637 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2017-15638 
The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; before 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; before 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; before 3.6.312-5.9.1 in openSUSE Leap 42.2; and before 3.6.312.333-7.1 in openSUSE Leap 42.3 might allow remote attackers to bypass intended access restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-09T19:00:00.000Z
CVE-2017-15639 
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T19:00:00.000Z
CVE-2017-15640 
app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-21T21:00:00.000Z