Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1786
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://framework.zend.com/changelog/2.3.6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1207781'}]
CVE State: PUBLISHED
Explain CVE-2015-1787
The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Affected Products: n/a
References: [{'url': 'https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=b19d8143212ae5fbc9cebfd51c01f802fabccd33'}, {'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10110'}, {'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'name': 'HPSBMU03409', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=144050155601375&w=2'}, {'url': 'https://bto.bluecoat.com/security-advisory/sa92'}, {'url': 'https://www.openssl.org/news/secadv_20150319.txt'}, {'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html'}, {'name': 'HPSBMU03380', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=143748090628601&w=2'}, {'url': 'http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html'}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1202406'}, {'name': '73238', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/73238'}, {'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'HPSBMU03397', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=144050297101809&w=2'}, {'name': '1031929', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1031929'}, {'name': 'GLSA-201503-11', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/201503-11'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1794
The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.
Affected Products: n/a
References: [{'name': '20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products', 'tags': ['vendor-advisory'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl'}, {'name': 'SSA:2015-349-04', 'tags': ['vendor-advisory'], 'url': 'http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583'}, {'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761'}, {'name': 'USN-2830-1', 'tags': ['vendor-advisory'], 'url': 'http://www.ubuntu.com/usn/USN-2830-1'}, {'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'url': 'http://openssl.org/news/secadv/20151203.txt'}, {'url': 'https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=ada57746b6b80beae73111fe1291bf8dd89af91c'}, {'name': '1034294', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1034294'}, {'name': 'openSUSE-SU-2016:0637', 'tags': ['vendor-advisory'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html'}, {'url': 'http://fortiguard.com/advisory/openssl-advisory-december-2015'}, {'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322'}, {'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1795
Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1200927'}, {'name': '1038128', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038128'}, {'name': '99311', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99311'}, {'name': 'RHSA-2017:0484', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2017-0484.html'}, {'name': 'RHSA-2017:0486', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2017-0486.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1796
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1176', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1176.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://shibboleth.net/community/advisories/secadv_20150225.txt'}, {'name': 'RHSA-2015:1177', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1177.html'}, {'name': '75370', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75370'}]
CVE State: PUBLISHED
Explain CVE-2015-1800
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Affected Products: n/a
References: [{'name': '[oss-security] 20150921 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/21/13'}, {'name': '76807', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76807'}, {'name': '[oss-security] 20150921 Samsung S4 (GT-I9500) multiple kernel vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/21/4'}, {'name': '[oss-security] 20150922 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/22/18'}]
CVE State: PUBLISHED
Explain CVE-2015-1801
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges.
Affected Products: n/a
References: [{'name': '[oss-security] 20150921 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/21/13'}, {'name': '76807', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76807'}, {'name': '[oss-security] 20150921 Samsung S4 (GT-I9500) multiple kernel vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/21/4'}]
CVE State: PUBLISHED
Explain CVE-2015-1802
The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'name': 'GLSA-201507-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-21'}, {'name': 'SUSE-SU-2015:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html'}, {'name': '73277', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73277'}, {'name': 'USN-2536-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2536-1'}, {'name': 'FEDORA-2015-4230', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html'}, {'name': 'RHSA-2015:1708', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1708.html'}, {'name': 'openSUSE-SU-2015:0614', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00032.html'}, {'name': '1031935', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031935'}, {'name': 'FEDORA-2015-4199', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3194', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3194'}, {'name': 'MDVSA-2015:145', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:145'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0113.html'}, {'name': 'SUSE-SU-2015:0702', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00005.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1803
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'name': 'GLSA-201507-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-21'}, {'name': 'SUSE-SU-2015:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html'}, {'name': 'USN-2536-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2536-1'}, {'name': 'FEDORA-2015-4230', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html'}, {'name': 'RHSA-2015:1708', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1708.html'}, {'name': 'openSUSE-SU-2015:0614', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00032.html'}, {'name': '1031935', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031935'}, {'name': 'FEDORA-2015-4199', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3194', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3194'}, {'name': 'MDVSA-2015:145', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:145'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0113.html'}, {'name': 'SUSE-SU-2015:0702', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00005.html'}, {'name': '73280', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73280'}]
CVE State: PUBLISHED
Explain CVE-2015-1804
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'name': 'GLSA-201507-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-21'}, {'name': 'SUSE-SU-2015:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html'}, {'name': 'openSUSE-SU-2015:2300', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-12/msg00074.html'}, {'name': 'USN-2536-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2536-1'}, {'name': 'FEDORA-2015-4230', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html'}, {'name': 'RHSA-2015:1708', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1708.html'}, {'name': 'openSUSE-SU-2015:0614', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00032.html'}, {'name': '1031935', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031935'}, {'name': 'FEDORA-2015-4199', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3194', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3194'}, {'name': 'MDVSA-2015:145', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:145'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0113.html'}, {'name': '73279', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73279'}, {'name': 'SUSE-SU-2015:0702', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00005.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1806
The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205620'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1807
Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205622'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1808
Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205623'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1809
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Affected Products: Jenkins
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205625'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jenkins.io/security/advisory/2015-02-27/'}]
CVE State: PUBLISHED
Explain CVE-2015-1810
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
Affected Products: n/a
References: [{'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205627'}]
CVE State: PUBLISHED
Explain CVE-2015-1811
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
Affected Products: Jenkins
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205632'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jenkins.io/security/advisory/2015-02-27/'}]
CVE State: PUBLISHED
Explain CVE-2015-1812
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205615'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1813
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205615'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1814
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205616'}, {'name': 'RHSA-2016:0070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:0070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23'}, {'name': 'RHSA-2015:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1844.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1815
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-4833', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154427.html'}, {'name': '73374', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73374'}, {'name': '36564', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36564/'}, {'name': 'FEDORA-2015-4838', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154444.html'}, {'name': '[oss-security] 20150326 Fwd: setroubleshoot root exploit (CVE-Request)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/26/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1206050'}, {'name': 'FEDORA-2015-4792', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154147.html'}, {'name': 'RHSA-2015:0729', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0729.html'}, {'name': '119966', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/119966'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/stealth/troubleshooter'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1203352'}]
CVE State: PUBLISHED
Explain CVE-2015-1816
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1592', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2015:1592'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/theforeman/foreman/pull/2265'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/9858'}, {'name': 'RHSA-2015:1591', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2015:1591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/foreman-announce/9ZnuPcplNLI'}]
CVE State: PUBLISHED
Explain CVE-2015-1817
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20150330 Security advisory for musl libc - stack-based buffer overflow in ipv6 literal parsing [CVE-2015-1817]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/30/3'}, {'name': '73408', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73408'}]
CVE State: PUBLISHED
Explain CVE-2015-1818
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1539', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1539.html'}, {'name': 'RHSA-2015:1704', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1704.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1820
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rest-client/rest-client/issues/369'}, {'name': '73295', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73295'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205291'}, {'name': '[oss-security] 20150323 CVE-2015-1820: ruby rest-client session fixation vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/24/3'}]
CVE State: PUBLISHED
Explain CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
Affected Products: n/a
References: [{'name': 'DSA-3222', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3222'}, {'name': '[chrony-announce] 20150407 chrony-1.31.1 released (security)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.html'}, {'name': '73955', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73955'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'GLSA-201507-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1822
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Affected Products: n/a
References: [{'name': 'DSA-3222', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3222'}, {'name': '[chrony-announce] 20150407 chrony-1.31.1 released (security)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'GLSA-201507-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-01'}, {'name': '73956', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73956'}]
CVE State: PUBLISHED
Explain CVE-2015-1827
The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1205200'}, {'name': 'FEDORA-2015-4747', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154314.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/freeipa/ticket/4908'}, {'name': '73376', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73376'}, {'name': 'FEDORA-2015-4788', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154103.html'}, {'name': 'RHSA-2015:0728', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0728.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1828
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://rubysec.com/advisories/http-CVE-2015-1828'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ruby/openssl/issues/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/httprb/jkb4oxwZjkU'}]
CVE State: PUBLISHED
Explain CVE-2015-1829
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.apache.org/dist/apr/Announcement1.x.html'}, {'name': '1032617', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032617'}, {'name': '75164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75164'}]
CVE State: PUBLISHED
Explain CVE-2015-1830
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt'}, {'name': '76452', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76452'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-15-407'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-15-407/'}, {'name': '1033315', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033315'}, {'name': '[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1831
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://struts.apache.org/docs/s2-024.html'}, {'name': '75940', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75940'}, {'name': '1032985', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032985'}]
CVE State: PUBLISHED
Explain CVE-2015-1832
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
Affected Products: n/a
References: [{'name': '93132', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/93132'}, {'name': '[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E'}, {'name': '[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E'}, {'name': '[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E'}, {'name': '[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E'}, {'name': '[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuoct2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/DERBY-6807'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21990100'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://svn.apache.org/viewvc?view=revision&revision=1691461'}]
CVE State: PUBLISHED
Explain CVE-2015-1833
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Affected Products: n/a
References: [{'name': 'DSA-3298', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3298'}, {'name': '74761', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74761'}, {'name': '37110', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/37110/'}, {'name': '[jackrabbit-announce] 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E'}, {'name': '20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/535582/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/JCR-3883'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1834
A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Affected Products: Cloud Foundry
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pivotal.io/security/cve-2015-1834'}, {'name': '98691', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98691'}]
CVE State: PUBLISHED
Explain CVE-2015-1835
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Affected Products: n/a
References: [{'name': '74866', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74866'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cordova.apache.org/announcements/2015/05/26/android-402.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1836
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Affected Products: n/a
References: [{'name': '[www-announce] 20150525 CVE-2015-1836: Apache HBase remote denial of service, information integrity, and information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5izmYccaKjXaJ3V72KK7tbOhbkg%40mail.gmail.com%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21969546'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html'}, {'name': '1034365', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034365'}]
CVE State: PUBLISHED
Explain CVE-2015-1838
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Affected Products: n/a
References: [{'name': 'FEDORA-2016-105b3b8804', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1212784'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1839
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1212788'}, {'name': 'FEDORA-2016-105b3b8804', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1840
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-10144', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html'}, {'name': 'openSUSE-SU-2015:1260', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html'}, {'name': '[oss-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2015/06/16/15'}, {'name': 'FEDORA-2015-10258', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html'}, {'name': '[rubyonrails-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J'}, {'name': '75239', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75239'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md'}]
CVE State: PUBLISHED
Explain CVE-2015-1841
The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view.
Affected Products: n/a
References: [{'name': '1033459', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033459'}, {'name': 'RHSA-2015:1713', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1713.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1842
The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2015:0791', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0791.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1201875'}, {'name': '74049', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74049'}, {'name': 'RHSA-2015:0831', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0831.html'}, {'name': 'RHSA-2015:0832', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0832.html'}, {'name': 'RHSA-2015:0789', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0789.html'}, {'name': 'RHSA-2015:0830', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0830.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1843
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.  NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
Affected Products: n/a
References: [{'name': 'RHSA-2015:0776', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0776.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1206443'}, {'name': '73936', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73936'}]
CVE State: PUBLISHED
Explain CVE-2015-1844
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1592', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2015:1592'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/9947'}, {'tags': ['x_refsource_MISC'], 'url': 'https://groups.google.com/forum/#%21topic/foreman-users/qAGZh5n6n6M'}, {'name': 'RHSA-2015:1591', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2015:1591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/theforeman/foreman/pull/2273'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/foreman-announce/37KYWhIk4FY'}]
CVE State: PUBLISHED
Explain CVE-2015-1845
Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '73693', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73693'}, {'name': '1032011', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032011'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1207645'}, {'name': '[oss-security] 20150401 CVE-2015-1845, CVE-2015-1846 - unzoo - Buffer overflow & Infinite loop', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/01/5'}]
CVE State: PUBLISHED
Explain CVE-2015-1846
unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling.
Affected Products: n/a
References: [{'name': '1032011', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032011'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1207647'}, {'name': '73686', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73686'}, {'name': '[oss-security] 20150401 CVE-2015-1845, CVE-2015-1846 - unzoo - Buffer overflow & Infinite loop', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/01/5'}]
CVE State: PUBLISHED