yahoo-inc/cve-impacts huggingface dataset:
CVE-2017-7571: public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges.
Key phrases: CSRF, csrf, admin privileges
CVE-2017-7572: The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.
Key phrases: race condition
CVE-2017-7574: Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.
Key phrases: hardcoded-key
CVE-2017-7575: Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \\\\x00\\\\x01\\\\x00\\\\x00\\\\x00\\\\x05\\\\x01\\\\x5a\\\\x00\\\\x03\\\\x00 request to the Modbus port (502/tcp). Subsequently the application may be arbitrarily downloaded, modified, and uploaded.
Key phrases: discover the application-protection password via a
CVE-2017-7576: DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. This is fixed in recent versions including 1.4.8.
Key phrases: access the devices, hardcoded login credentials
CVE-2017-7577: XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request.
Key phrases: the reading of arbitrary files via a ", directory traversal
CVE-2017-7578: Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service (listswf application crash) or possibly have unspecified other impact via a crafted SWF file. NOTE: this issue exists because of an incomplete fix for CVE-2016-9831.
Key phrases: denial of service (listswf application crash), cause a denial of service (listswf application, heap-based buffer overflows, unspecified other impact, heap based buffer overflow, unspecified impact
CVE-2017-7579: inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
Key phrases: xss
CVE-2017-7581: SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via vectors involving overwriteDemand, sql injection, arbitrary sql commands
CVE-2017-7583: ILIAS before 5.2.3 has XSS via SVG documents.
Key phrases: xss
CVE-2017-7584: Memory Corruption Vulnerability in Foxit PDF Toolkit before 2.1 allows an attacker to cause Denial of Service & Remote Code Execution when a victim opens a specially crafted PDF file.
Key phrases: cause Denial of Service & Remote Code Execution, memory corruption, denial of service, remote code execution
CVE-2017-7585: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2017-7586: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2017-7588: On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W.
Key phrases: authcookie cookie
CVE-2017-7589: In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js.
Key phrases: missing access-control check, sensitive information
CVE-2017-7590: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
Key phrases: persistent cross-site scripting (xss)
CVE-2017-7591: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
Key phrases: reflected cross-site scripting (xss)
CVE-2017-7592: The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, left-shift undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7593: tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.
Key phrases: obtain sensitive information, obtain sensitive information from process memory via a
CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.
Key phrases: denial of service (memory leak), cause a denial of service (memory leak
CVE-2017-7595: The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
Key phrases: denial of service (divide-by-zero error and application crash), cause a denial of service (divide-
CVE-2017-7596: LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7597: tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7598: tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
Key phrases: denial of service (divide-by-zero error and application crash), cause a denial of service (divide-
CVE-2017-7599: LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, outside the range of representable values of type short, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7600: LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, outside the range of representable values of type unsigned char, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7601: LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7602: LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, signed integer overflow, unspecified other impact, unspecified impact
CVE-2017-7603: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, signed integer overflow, unspecified other impact, unspecified impact
CVE-2017-7604: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, left-shift undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7605: aacplusenc.c in HE-AAC+ Codec (aka libaacplus) 2.0.2 has an assertion failure, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, assertion failure, unspecified other impact, unspecified impact
CVE-2017-7606: coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, undefined behavior issue, unspecified other impact, unspecified impact
CVE-2017-7607: The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7608: The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7609: elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2017-7610: The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7611: The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7612: The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7613: elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2017-7614: elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified other impact, null pointer, unspecified impact
CVE-2017-7615: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
Key phrases: allows arbitrary password reset, verify.php, unauthenticated admin access, empty confirm_hash value
CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.
Key phrases: obtain sensitive information, obtain sensitive information from uninitialized stack data by
CVE-2017-7617: Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.
Key phrases: remote code execution, buffer overflow
CVE-2017-7618: crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
Key phrases: denial of service (API operation calling its own callback, and infinite recursion), cause a denial of service (API operation, ebusy
CVE-2017-7619: In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.
Key phrases: infinite loop, floating-point rounding error
CVE-2017-7620: MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \\\\/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
Key phrases: permalink injection, csrf, open redirect
CVE-2017-7621: Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/student_portal/home.php. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.
Key phrases: send malicious code, cross site scripting
CVE-2017-7622: dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anybody can change the grub config, even to append some arguments to make a backdoor or privilege escalation, by calling DoWriteGrubSettings() provided by dde-daemon.
Key phrases: backdoor, privilege escalation, root privilege
CVE-2017-7623: The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2017-7624: The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file.
Key phrases: consume an amount of available memory via a
CVE-2017-7625: In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.
Key phrases: webshell, execute code
CVE-2017-7626: The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
Key phrases: xss
CVE-2017-7627: The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php (there is a missing _JEXEC check).
Key phrases: _jexec check
CVE-2017-7628: The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php (attacker must use search_cats variable in POST method to exploit this vulnerability).
Key phrases: sql injection
CVE-2017-7629: QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.
CVE-2017-7630: QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and running services) via a request to sysinfoReq.cgi.
Key phrases: obtain potentially sensitive information, obtain potentially sensitive information (firmware version and
CVE-2017-7631: Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2017-7632: Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2017-7633: QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device.
Key phrases: further compromise the device, sensitive information
CVE-2017-7634: Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2017-7635: QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.
Key phrases: csrf protections
CVE-2017-7636: Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2017-7637: QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges.
Key phrases: run arbitrary OS commands, run arbitrary OS commands against the system with, arbitrary os command, root privilege
CVE-2017-7638: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.
Key phrases: exploitation, leakage of sensitive information
CVE-2017-7639: QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server.
Key phrases: successful exploitation, change of the settings
CVE-2017-7640: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges.
Key phrases: run arbitrary OS commands, run arbitrary OS commands against the system with, arbitrary os command, root privilege
CVE-2017-7641: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections.
Key phrases: csrf protections
CVE-2017-7642: The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.
Key phrases: gain root privileges, gain root privileges by leveraging failure to verify, failure to verify the path to the encoded ruby script
CVE-2017-7643: Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program.
Key phrases: gain privileges, gain privileges via the first parameter to the
CVE-2017-7644: The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541.
Key phrases: obtain sensitive information, obtain sensitive information by leveraging incorrect permission validation
CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.
Key phrases: denial of service (system crash), cause a denial of service (system crash
CVE-2017-7646: SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the contents of arbitrary files contained within.
Key phrases: browse the server's filesystem and read the, arbitrary files
CVE-2017-7647: SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.
Key phrases: execute arbitrary commands
CVE-2017-7648: Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Key phrases: defeat cryptographic protection mechanisms by leveraging knowledge of, hardcoded
CVE-2017-7649: The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
Key phrases: be configured, log into Kura without any user credentials over, unencrypted telnet, execute commands
CVE-2017-7650: In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
Key phrases: access MQTT topics that they do have the
CVE-2017-7651: In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.
CVE-2017-7652: In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
CVE-2017-7653: The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
Key phrases: invalid strings, denial of service
CVE-2017-7654: In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker.
Key phrases: memory leak, denial of service
CVE-2017-7655: In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library.
Key phrases: null dereference, crashes
CVE-2017-7656: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Key phrases: generate arbitrary content, poison the cache
CVE-2017-7657: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Key phrases: bypass the authorization imposed by the intermediary as, integer overflow, bypass authorization
CVE-2017-7658: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Key phrases: bypass that authorization, bypass authorization
CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
Key phrases: null pointer, crash the server process
CVE-2017-7660: Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
CVE-2017-7661: Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
Key phrases: csrf (cross style request forgery)
CVE-2017-7662: Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.
Key phrases: be created, csrf (cross style request forgery)
CVE-2017-7663: Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.
Key phrases: xss
CVE-2017-7664: Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.
CVE-2017-7665: In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
Key phrases: xss issues
CVE-2017-7666: Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
Key phrases: cross-site request forgery (csrf), xss, click-jacking, mime based
CVE-2017-7667: Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
Key phrases: framing with the same origin
CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
Key phrases: search past the end of its input string, sequence of request headers, segmentation fault, incorrect value
CVE-2017-7669: In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
Key phrases: insufficient input validation, run commands
CVE-2017-7670: The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.
Key phrases: denial of service
CVE-2017-7671: There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.
Key phrases: dos, coredump
CVE-2017-7672: If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Key phrases: prepare a special URL which will be used, special url
CVE-2017-7673: Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
Key phrases: brute force protection
CVE-2017-7674: The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Key phrases: server side cache poisoning
CVE-2017-7675: The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Key phrases: bypass security constraints, directory traversal
CVE-2017-7676: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
Key phrases: unintended behavior
CVE-2017-7677: In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
Key phrases: rwx permission
CVE-2017-7678: In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
CVE-2017-7680: Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
Key phrases: be loaded from untrusted domains, crossdomain.xml file
CVE-2017-7681: Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
Key phrases: modify the structure of the existing query and, sql injection, leak
CVE-2017-7682: Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
Key phrases: parameter manipulation
CVE-2017-7683: Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.
Key phrases: secure
CVE-2017-7684: Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
Key phrases: denial of service, file upload
CVE-2017-7685: Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.
Key phrases: insecure http methods
CVE-2017-7686: Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
Key phrases: sensitive information
CVE-2017-7687: When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Key phrases: denial of service, inoperable, crash
CVE-2017-7688: Apache OpenMeetings 1.0.0 updates user password in insecure manner.
Key phrases: insecure manner
CVE-2017-7689: A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0.
Key phrases: command injection
CVE-2017-7690: Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary with a Trojan horse program.
Key phrases: gain privileges, gain privileges by replacing the KLoader binary with
CVE-2017-7691: A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The vendor response is SAP Security Note 2419592.
Key phrases: code injection
CVE-2017-7692: SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation, the attacker must upload a sendmail.cf file as an email attachment, and inject the sendmail.cf filename with the -C option within the "Options > Personal Informations > Email Address" setting.
Key phrases: execute arbitrary shell commands, exploit this vulnerability to execute arbitrary shell commands, use it as a command-line program, remote code execution, arbitrary commands
CVE-2017-7693: Directory traversal vulnerability in viewer_script.jsp in Riverbed OPNET App Response Xpert (ARX) version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files.
Key phrases: inject arbitrary commands, inject arbitrary commands to read OS files, directory traversal
CVE-2017-7694: Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.
Key phrases: execute code and get a webshell from the, remote code execution
CVE-2017-7695: Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
Key phrases: bypass a safety check, unrestricted file upload, execute code
CVE-2017-7696: SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr, aka SAP Security Note 2389042.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2017-7697: In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
Key phrases: buffer over-read, buffer over read
CVE-2017-7698: A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document, possibly a consequence of an error in Gfx.cc in Xpdf 3.02.
Key phrases: execute arbitrary code, execute arbitrary code via a malformed PDF document, use after free, consequence
CVE-2017-7700: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by ensuring a nonzero record size.
Key phrases: infinite loop, malformed capture file
CVE-2017-7701: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type.
Key phrases: infinite loop, packet injection, malformed capture file
CVE-2017-7702: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.
Key phrases: infinite loop, packet injection, malformed capture file
CVE-2017-7703: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly.
Key phrases: packet injection, malformed capture file, crash
CVE-2017-7704: In Wireshark 2.2.0 to 2.2.5, the DOF dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dof.c by using a different integer data type and adjusting a return value.
Key phrases: infinite loop, packet injection, malformed capture file
CVE-2017-7705: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rpcrdma.c by correctly checking for going beyond the maximum offset.
Key phrases: infinite loop, packet injection, malformed capture file
CVE-2017-7716: The read_u32_leb128 function in libr/util/uleb128.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.
Key phrases: denial of service (heap-based buffer over-read and application crash), cause a denial of service (heap-, buffer over read
CVE-2017-7717: SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection, arbitrary sql commands
CVE-2017-7718: hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.
Key phrases: denial of service (out-of-bounds read and QEMU process crash), cause a denial of service (out-, out of bounds read
CVE-2017-7719: SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Key phrases: sql injection
CVE-2017-7720: Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long password.
Key phrases: denial of service (SEH overwrite), cause a denial of service (SEH overwrite, buffer overflow, unspecified other impact, long password, unspecified impact
CVE-2017-7721: IrfanView version 4.44 (32bit) with FPX Plugin before 4.45 has an Access Violation and crash in processing a FlashPix (.FPX) file.
Key phrases: access violation, crash
CVE-2017-7722: In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" (the default username and password). By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the restricted shell.
CVE-2017-7723: XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
Key phrases: xss
CVE-2017-7725: concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
Key phrases: be set for certain links displayed to subsequent, xss vector
CVE-2017-7726: iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
Key phrases: ssl certificate validation
CVE-2017-7728: On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the alarm on/off), related to incorrect cryptography.
Key phrases: bypass leading to remote execution of commands (e.g., authentication bypass, incorrect cryptography
CVE-2017-7729: On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.
Key phrases: incorrect access control, cleartext
CVE-2017-7730: iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding.
Key phrases: Denial of Service, denial of service, syn flood, freeze, stop responding
CVE-2017-7731: A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature.
Key phrases: carry out information disclosure via the Forgotten Password, password recovery
CVE-2017-7732: A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via crafted, cross-site scripting (xss)