rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-17859 
Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML file does not have a document.domain value corresponding to the domain that is hosting the MHTML file, but instead has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T07:00:00.000Z
CVE-2017-17860 
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-18T22:00:00.000Z
CVE-2017-17862 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T17:00:00.000Z
CVE-2017-17863 
kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T17:00:00.000Z
CVE-2017-17864 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T17:00:00.000Z
CVE-2017-17866 
pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T17:00:00.000Z
CVE-2017-17867 
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2017-17868 
In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T23:00:00.000Z
CVE-2017-17869 
The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T23:00:00.000Z
CVE-2017-17870 
The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T23:00:00.000Z
CVE-2017-17871 
The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T00:00:00.000Z
CVE-2017-17872 
The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T00:00:00.000Z
CVE-2017-17873 
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T00:00:00.000Z
CVE-2017-17874 
Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T00:00:00.000Z
CVE-2017-17875 
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T18:00:00.000Z
CVE-2017-17876 
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T18:00:00.000Z
CVE-2017-17877 
An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet (with stateless address autoconfiguration) by default, which makes it easier for remote attackers to obtain access by guessing 24 bits of the MAC address and attempting a root login. This can be exploited in conjunction with CVE-2017-17878.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T02:00:00.000Z
CVE-2017-17878 
An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des" setting).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T02:00:00.000Z
CVE-2017-17879 
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17880 
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17881 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted MAT image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17882 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted XPM image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17883 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to cause a denial of service via a crafted PGX image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17884 
In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17885 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17886 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service via a crafted psd image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17887 
In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in magick/cache.c, which allows attackers to cause a denial of service via a crafted MNG image file that is processed by ReadOneMNGImage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T04:00:00.000Z
CVE-2017-17888 
cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 --> AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content, a different vulnerability than CVE-2017-9097.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T16:00:00.000Z
CVE-2017-17889 
Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-22T15:00:00.000Z
CVE-2017-17891 
Readymade Video Sharing Script has CSRF via user-profile-edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17892 
Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the search_video.php search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17893 
Readymade Video Sharing Script has XSS via the search_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17894 
Readymade Job Site Script has CSRF via the /job URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17895 
Readymade Job Site Script has SQL Injection via the location_name array parameter to the /job URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17896 
Readymade Job Site Script has XSS via the keyword parameter to the /job URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17897 
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17898 
Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17899 
SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17900 
SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17901 
ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T22:00:00.000Z
CVE-2017-17902 
SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-22T15:00:00.000Z
CVE-2017-17903 
FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17904 
FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17905 
PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17906 
PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17907 
PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17908 
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17909 
PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T16:00:00.000Z
CVE-2017-17910 
On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. An attacker can intercept an arbitrary radio frame exchanged between a BiSecur transmitter and a receiver to obtain the encrypted packet and the 32-bit serial number. The interception of the one-time pairing process is specifically not required. Due to use of AES-128 with an initial static random value and static data vector (all of this static information is the same across different customers' installations), the attacker can easily derive the utilized encryption key and decrypt the intercepted packet. The key can be verified by decrypting the intercepted packet and checking for known plaintext. Subsequently, an attacker can create arbitrary radio frames with the correct encryption key to control BiSecur garage and entrance gate operators and possibly other BiSecur systems as well ("wireless cloning"). To conduct the attack, a low cost Software Defined Radio (SDR) is sufficient. This affects Hoermann Hand Transmitter HS5-868-BS, HSE1-868-BS, and HSE2-868-BS devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T19:00:00.000Z
CVE-2017-17911 
packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T19:00:00.000Z
CVE-2017-17912 
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T20:00:00.000Z
CVE-2017-17913 
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incompatibility with libwebp versions, 0.5.0 and later, that use a different structure type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T20:00:00.000Z
CVE-2017-17914 
In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T20:00:00.000Z
CVE-2017-17915 
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T20:00:00.000Z
CVE-2017-17916 
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T16:00:00.000Z
CVE-2017-17917 
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T16:00:00.000Z
CVE-2017-17919 
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T16:00:00.000Z
CVE-2017-17920 
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T16:00:00.000Z
CVE-2017-17924 
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17925 
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17926 
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17927 
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17928 
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17929 
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17930 
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17931 
PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-26T22:00:00.000Z
CVE-2017-17932 
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17933 
cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T18:00:00.000Z
CVE-2017-17934 
ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-27T07:00:00.000Z
CVE-2017-17935 
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-27T07:00:00.000Z
CVE-2017-17936 
Vanguard Marketplace Digital Products PHP has CSRF via /search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17937 
Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17938 
PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17939 
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17940 
PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17941 
PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z
CVE-2017-17942 
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-28T06:00:00.000Z