CVE-2017-7796

MEDIUM Year: 2017
CVSS v3 Score
4.7
Medium
CVSS v2 Score
3.3
Low
Weakness Type
CWE-20
View all →

Vulnerability Description

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.

Related Vulnerabilities

CVE-2016-9263

MEDIUM
CVSS:4.7(Medium)

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained with...

CWE-202016

CVE-2017-0354

MEDIUM
CVSS:4.7(Medium)

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain function requiring lower IRQL can be made under...

CWE-202017

CVE-2017-15333

MEDIUM
CVSS:4.7(Medium)

XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V...

CWE-202017

CVE-2017-15346

MEDIUM
CVSS:4.7(Medium)

XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V...

CWE-202017

CVE-2017-18103

MEDIUM
CVSS:4.7(Medium)

The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a c...

CWE-202017

CVE-2017-18430

MEDIUM
CVSS:4.7(Medium)

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).

CWE-202017