rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-14373 
EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Reflected Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: RSA Authentication Manager 8.2 SP1 P4 and earlier
Published: 2017-10-31T07:00:00.000Z
CVE-2017-14374 
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).
Problem types: description: Hard-coded Password Vulnerability
Affected products: vendor: n/a
product: Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20
Published: 2017-12-06T00:00:00.000Z
CVE-2017-14375 
EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, and EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier) contain an authentication bypass vulnerability that may potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: EMC VMAX Virtual Appliance (vApp) EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier)
Published: 2017-11-01T01:00:00.000Z
CVE-2017-14376 
EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Hardcoded Password Vulnerability
Affected products: vendor: n/a
product: EMC AppSync Server versions prior to 3.5.0.1
Published: 2017-11-01T01:00:00.000Z
CVE-2017-14377 
EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 have a security vulnerability that could potentially lead to authentication bypass.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618
Published: 2017-11-29T18:00:00.000Z
CVE-2017-14378 
EMC RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C allow attackers to bypass authentication, aka an "Error Handling Vulnerability."
Problem types: description: Error Handling Vulnerability
Affected products: vendor: n/a
product: RSA Authentication Agent SDK RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C
Published: 2017-11-29T18:00:00.000Z
CVE-2017-14379 
EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Stored Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: RSA Authentication Manager software version 8.2 SP1 P5 and earlier
Published: 2017-11-28T07:00:00.000Z
CVE-2017-14380 
In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account user could exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS 8.1.0.0, 8.0.1.0 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, 7.1.1.x
Published: 2017-12-13T20:00:00.000Z
CVE-2017-14383 
In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary HTML code in the user's browser session in the context of the affected web application.
Problem types: description: Reflected Cross Site Scripting Vulnerability
Affected products: vendor: n/a
product: Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and Dell EMC VNX1 versions prior to Operating Environment for File 7.1.80.8
Published: 2018-01-04T06:00:00.000Z
CVE-2017-14384 
In Dell Storage Manager versions earlier than 16.3.20, the EMConfigMigration service is affected by a directory traversal vulnerability. A remote malicious user could potentially exploit this vulnerability to read unauthorized files by supplying specially crafted strings in input parameters of the application. A malicious user cannot delete or modify any files via this vulnerability.
Problem types: description: Directory traversal vulnerability
Affected products: vendor: Dell EMC
product: Dell Storage Manager
Published: 2018-03-16T20:00:00.000Z
CVE-2017-14385 
An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution.
Problem types: description: Memory Overflow Vulnerability
Affected products: vendor: n/a
product: EMC Data Domain DD OS EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6, EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9, EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21, EMC Data Domain Virtual Edition 2.0 family, all versions, EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1, EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2
Published: 2017-12-20T23:00:00.000Z
CVE-2017-14386 
The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A10 respectively, are affected by a cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.
Problem types: description: Cross-site scripting vulnerability
Affected products: vendor: n/a
product: Dell 2335dn Firmware and Dell 2355DN Firmware Version V2.70.45.34, A10 and Version V2.70.06.26, A13
Published: 2017-12-07T19:00:00.000Z
CVE-2017-14387 
The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NFS export security flavor for authentication) that can be leveraged by current and future NFS exports. This NFS service contained a flaw that did not properly propagate changes made to the default security flavor to all new and existing NFS exports that are configured to use default NFS export settings and that are mounted after those changes are made. This flaw may potentially allow NFS clients to access affected NFS exports using the default and potentially weaker security flavor even if a more secure one was selected to be used by the OneFS administrator, aka an "NFS Export Security Setting Fallback Vulnerability."
Problem types: description: NFS Export Security Setting Fallback Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS EMC Isilon OneFS 8.1.0.0, EMC Isilon OneFS 8.0.1.0 -- 8.0.1.1, EMC Isilon OneFS 8.0.0.0 8.0.0.4
Published: 2017-12-20T23:00:00.000Z
CVE-2017-14388 
Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer.
Problem types: description: Does not validate DiffIDs
Affected products: vendor: n/a
product: GrootFS release GrootFS release 0.3.x versions prior to 0.30.0
Published: 2017-11-13T17:00:00.000Z
CVE-2017-14389 
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover."
Problem types: description: Application Subdomain Takeover
Affected products: vendor: n/a
product: Cloud Foundry capi-release: All versions prior to 1.45.0, cf-release: All versions prior to v280, cf-deployment: All versions prior to v1.0.0
Published: 2017-11-28T07:00:00.000Z
CVE-2017-14390 
In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintended locations.
Problem types: description: syslog misconfiguration
Affected products: vendor: n/a
product: cf-deployment cf-deployment v0.35.0
Published: 2017-11-27T10:00:00.000Z
CVE-2017-14394 
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T21:22:20.000Z
CVE-2017-14395 
Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T21:22:29.000Z
CVE-2017-14396 
In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T21:00:00.000Z
CVE-2017-14397 
AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T21:00:00.000Z
CVE-2017-14398 
rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T08:00:00.000Z
CVE-2017-14399 
In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T21:00:00.000Z
CVE-2017-14400 
In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T21:00:00.000Z
CVE-2017-14401 
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14402 
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14403 
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14404 
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/select_tool.php, as demonstrated by a tool_list=php://filter/ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14405 
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14406 
A NULL pointer dereference was discovered in sync_buffer in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14407 
A stack-based buffer over-read was discovered in filterYule in gain_analysis.c in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14408 
A stack-based buffer over-read was discovered in dct36 in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14409 
A buffer overflow was discovered in III_dequantize_sample in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14410 
A buffer over-read was discovered in III_i_stereo in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14411 
A stack-based buffer overflow was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14412 
An invalid memory write was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a denial of service (segmentation fault and application crash) or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T03:00:00.000Z
CVE-2017-14413 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wpsacts.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14414 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/shareport.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14415 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/sitesurvey.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14416 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wandetect.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14417 
register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14418 
The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14419 
The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices, participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, even though a TCP relay service for HTTPS is also established.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14420 
The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14421 
D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon device reset, which allows remote attackers to obtain root access via a TELNET session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14422 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14423 
htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessing attacks, which makes it easier for remote attackers to change the DNS configuration via a series of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14424 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14425 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14426 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /etc/shadow symlink target) permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14427 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_root permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14428 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/hostapd* permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14429 
The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters, affecting generated files such as WAN-1-udhcpc.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14430 
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allow remote attackers to cause a denial of service (daemon crash) via crafted LAN traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T17:00:00.000Z
CVE-2017-14431 
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T22:00:00.000Z
CVE-2017-14432 
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0_tmp= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.
Problem types: description: command injection
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-14433 
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.
Problem types: description: command injection
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z