rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-7840 
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks if users were convinced to add malicious tags to bookmarks, export them, and then open the resulting file. This vulnerability affects Firefox < 57.
Problem types: description: Exported bookmarks do not strip script elements from user-supplied tags
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7842 
If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of one. One of these requests includes the referrer instead of respecting the set policy to not include a referrer on requests. This vulnerability affects Firefox < 57.
Problem types: description: Referrer Policy is not always respected for <link> elements
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7843 
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Problem types: description: Web worker in Private Browsing mode can write IndexedDB data
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7844 
A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier releases are not affected. This vulnerability affects Firefox < 57.0.1.
Problem types: description: Visited history information leak through SVG image
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7845 
A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox < 57.0.2.
Problem types: description: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7846 
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects Thunderbird < 52.5.2.
Problem types: description: JavaScript Execution via RSS in mailbox:// origin
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7847 
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2.
Problem types: description: Local path string can be leaked from RSS feed
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7848 
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2.
Problem types: description: RSS Feed vulnerable to new line Injection
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7849 
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-19T14:00:00.000Z
CVE-2017-7850 
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-19T14:00:00.000Z
CVE-2017-7851 
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-15T08:00:00.000Z
CVE-2017-7852 
D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T10:00:00.000Z
CVE-2017-7853 
In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T15:00:00.000Z
CVE-2017-7854 
The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T16:00:00.000Z
CVE-2017-7855 
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T21:00:00.000Z
CVE-2017-7856 
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7857 
FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7858 
FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7859 
FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7860 
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7861 
Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7862 
FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7863 
FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7864 
FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7865 
FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7866 
FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7867 
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7868 
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7869 
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7870 
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T04:30:00.000Z
CVE-2017-7871 
trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7875 
In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7876 
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517, QTS 4.3.3.0174 build 20170503 and later versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2017-06-15T20:00:00.000Z
CVE-2017-7877 
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7878 
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7879 
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7881 
BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/_header.php and patched in core/inc/bigtree/admin.php on 2017-04-14.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-15T16:00:00.000Z
CVE-2017-7882 
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-15T16:00:00.000Z
CVE-2017-7884 
In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T13:00:00.000Z
CVE-2017-7885 
Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T00:00:00.000Z
CVE-2017-7886 
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-10T14:00:00.000Z
CVE-2017-7887 
Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-10T14:00:00.000Z
CVE-2017-7888 
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-10T14:00:00.000Z
CVE-2017-7889 
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T00:00:00.000Z
CVE-2017-7890 
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2017-7891 
sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T14:00:00.000Z
CVE-2017-7892 
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T21:00:00.000Z
CVE-2017-7893 
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-23T22:00:00.000Z
CVE-2017-7894 
WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in WinDjView.exe. One threat model is a victim who obtains an untrusted .djvu file from a remote location and issues several user-defined commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-7895 
The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T10:00:00.000Z
CVE-2017-7896 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-18T15:00:00.000Z
CVE-2017-7897 
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-18T17:00:00.000Z
CVE-2017-7898 
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. There are no penalties for repeatedly entering incorrect passwords.
Problem types: cwe_id: CWE-307
description: CWE-307
Affected products: vendor: n/a
product: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400
Published: 2017-06-30T02:35:00.000Z
CVE-2017-7899 
An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. User credentials are sent to the web server using the HTTP GET method, which may result in the credentials being logged. This could make user credentials available for unauthorized retrieval.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400
Published: 2017-06-30T02:35:00.000Z
CVE-2017-7901 
A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. Insufficiently random TCP initial sequence numbers are generated, which may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections, resulting in a denial of service for the target device.
Problem types: cwe_id: CWE-343
description: CWE-343
Affected products: vendor: n/a
product: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400
Published: 2017-06-30T02:35:00.000Z
CVE-2017-7902 
A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected product reuses nonces, which may allow an attacker to capture and replay a valid request until the nonce is changed.
Problem types: cwe_id: CWE-323
description: CWE-323
Affected products: vendor: n/a
product: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400
Published: 2017-06-30T02:35:00.000Z