CVE-2017-17946

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-01-10T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long \"Title name\" field in \"mail box\" data that is mishandled in an \"Open from mail box\" action."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-10T19:57:02.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1"}, {"tags": ["x_refsource_MISC"], "url": "http://seclists.org/fulldisclosure/2018/Jan/22"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-17946", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long \"Title name\" field in \"mail box\" data that is mishandled in an \"Open from mail box\" action."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1", "refsource": "MISC", "url": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1"}, {"name": "http://seclists.org/fulldisclosure/2018/Jan/22", "refsource": "MISC", "url": "http://seclists.org/fulldisclosure/2018/Jan/22"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T21:06:49.872Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2018/Jan/22"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-17946", "datePublished": "2018-01-10T20:00:00.000Z", "dateReserved": "2017-12-28T00:00:00.000Z", "dateUpdated": "2024-08-05T21:06:49.872Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:novosoft:handy_password:4.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "A1DFB077-02D8-4D50-9289-93EE4859353F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long \"Title name\" field in \"mail box\" data that is mishandled in an \"Open from mail box\" action."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en Handy Password 4.9.3 permite que los atacantes remotos ejecuten c\u00f3digo arbitrario mediante un campo \"Title name\" largo en los datos \"mail box\" que se gestionan de manera incorrecta en una acci\u00f3n \"Open from mail box\"."}], "id": "CVE-2017-17946", "lastModified": "2026-06-17T01:11:56.300", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-10T20:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2018/Jan/22"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2018/Jan/22"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}