rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-5854 
base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5855 
The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5856 
Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T15:00:00.000Z
CVE-2017-5857 
Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T15:00:00.000Z
CVE-2017-5858 
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T20:00:00.000Z
CVE-2017-5859 
On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T10:29:00.000Z
CVE-2017-5863 
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T19:45:38.000Z
CVE-2017-5864 
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T19:38:05.000Z
CVE-2017-5865 
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T15:00:00.000Z
CVE-2017-5866 
The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T15:00:00.000Z
CVE-2017-5867 
ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T15:00:00.000Z
CVE-2017-5868 
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-5869 
Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the X-File-Name header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T14:00:00.000Z
CVE-2017-5870 
Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) transport parameter to domain/add; the (3) name parameter to mailbox/add/did/<domain id>; the (4) goto parameter to alias/add/did/<domain id>; or the (5) captchatext parameter to auth/lost-password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-23T03:56:00.000Z
CVE-2017-5871 
Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T19:33:41.000Z
CVE-2017-5872 
The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246, which triggers a full memory dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-5873 
Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T15:00:00.000Z
CVE-2017-5874 
CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-22T05:31:00.000Z
CVE-2017-5875 
XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T15:00:00.000Z
CVE-2017-5876 
XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T15:00:00.000Z
CVE-2017-5877 
XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T15:00:00.000Z
CVE-2017-5878 
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2017-5879 
An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T15:00:00.000Z
CVE-2017-5880 
Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted GET request, aka SPL-130279.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-04T05:20:00.000Z
CVE-2017-5881 
GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2017-5882 
Cross-site scripting (XSS) vulnerability in index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-04T18:00:00.000Z
CVE-2017-5884 
gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-28T18:00:00.000Z
CVE-2017-5885 
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-28T18:00:00.000Z
CVE-2017-5886 
Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5887 
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur in the initStreamsWithData function).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-06T14:00:00.000Z
CVE-2017-5891 
ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-10T05:14:00.000Z
CVE-2017-5892 
ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-10T05:14:00.000Z
CVE-2017-5896 
Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T19:00:00.000Z
CVE-2017-5897 
The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-5898 
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T19:00:00.000Z
CVE-2017-5899 
Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T15:00:00.000Z
CVE-2017-5900 
Cross-site scripting (XSS) vulnerability in the NetComm NB16WV-02 router with firmware NB16WV_R0.09 allows remote authenticated users to inject arbitrary web script or HTML via the S801F0334 parameter to hdd.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T14:00:00.000Z
CVE-2017-5901 
The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5902 
The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5905 
The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5906 
The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5907 
The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5909 
The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5911 
The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5912 
The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5913 
The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5914 
The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5915 
The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5916 
The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5918 
The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5919 
The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-5923 
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-5924 
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-5925 
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-5926 
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-5927 
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-5928 
The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-5929 
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-13T06:14:00.000Z
CVE-2017-5930 
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2017-5931 
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T15:00:00.000Z
CVE-2017-5932 
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T15:00:00.000Z
CVE-2017-5933 
Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-08T16:00:00.000Z
CVE-2017-5934 
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T19:00:00.000Z
CVE-2017-5936 
OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2017-5937 
The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T19:00:00.000Z
CVE-2017-5938 
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-5940 
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T18:00:00.000Z
CVE-2017-5941 
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T19:00:00.000Z