Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1338
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Affected Products: n/a
References: [{'name': 'USN-2744-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2744-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/apport/trunk/2.19'}, {'name': '38353', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/38353/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/'}, {'name': '20150927 Apport kernel_crashdump symlink vulnerability exploitation', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Sep/101'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1339
Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.
Affected Products: n/a
References: [{'name': '[oss-security] 20160302 CVE-2015-1339: Linux Kernel: memory exhaustion via CUSE driver', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/03/02/13'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c5816b4beccc8ba709144539f6fdd764f8fa49c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1314331'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/2c5816b4beccc8ba709144539f6fdd764f8fa49c'}, {'name': 'SUSE-SU-2016:1707', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=969356'}, {'name': 'openSUSE-SU-2016:1008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2015-1339'}]
CVE State: PUBLISHED
Explain CVE-2015-1340
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Affected Products: LXD
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4'}]
CVE State: PUBLISHED
Explain CVE-2015-1341
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
Affected Products: Apport
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/apport/trunk/2.19.2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://usn.ubuntu.com/2782-1/'}]
CVE State: PUBLISHED
Explain CVE-2015-1342
LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1508481'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lxc/lxcfs/commit/a8b6c3e0537e90fba3c55910fd1b7229d54a60a7'}, {'name': 'USN-2813-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2813-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1344
The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1512854'}, {'name': 'USN-2813-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2813-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lxc/lxcfs/commit/8ee2a503e102b1a43ec4d83113dc275ab20a869a'}]
CVE State: PUBLISHED
Explain CVE-2015-1345
The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'RHSA-2015:1447', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1447.html'}, {'name': 'openSUSE-SU-2015:0243', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00037.html'}, {'name': '72281', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72281'}, {'name': '[oss-security] 20150122 Re: CVE request: grep heap buffer overrun', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/22/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2'}]
CVE State: PUBLISHED
Explain CVE-2015-1346
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/01/stable-update.html'}, {'name': '62575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62575'}, {'name': 'google-v8-cve20151346-code-exec(100361)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100361'}, {'name': 'USN-2476-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2476-1'}, {'name': 'GLSA-201502-13', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201502-13.xml'}, {'name': '1031623', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031623'}, {'name': 'RHSA-2015:0093', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0093.html'}, {'name': '62383', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62383'}]
CVE State: PUBLISHED
Explain CVE-2015-1347
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osTicket/osTicket-1.8/commit/b38b3ca7235002137cc9ff74b3c24a4a78c9c2d1'}]
CVE State: PUBLISHED
Explain CVE-2015-1348
Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/support/alerts/aruba-psa-2015-001.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-1349
named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1326', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.juniper.net/JSA10783'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0082.html'}, {'name': 'MDVSA-2015:165', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:165'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.isc.org/article/AA-01235'}, {'name': 'SUSE-SU-2015:1205', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00013.html'}, {'name': 'openSUSE-SU-2015:1250', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00038.html'}, {'name': 'MDVSA-2015:054', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10116'}, {'name': 'FEDORA-2015-2543', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150904.html'}, {'name': 'GLSA-201510-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201510-01'}, {'name': 'HPSBUX03379', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=143740940810833&w=2'}, {'name': 'SSRT101976', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=143740940810833&w=2'}, {'name': 'USN-2503-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2503-1'}, {'name': 'FEDORA-2015-2548', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150905.html'}, {'name': 'APPLE-SA-2015-09-16-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT205219'}, {'name': 'RHSA-2015:0672', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0672.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1193820'}]
CVE State: PUBLISHED
Explain CVE-2015-1350
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1185139'}, {'name': '76075', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76075'}, {'name': '[linux-kernel] 20150117 [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-kernel&m=142153722930533&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770492'}, {'name': '[oss-security] 20150124 Re: CVE Request: Linux kernel - Denial of service in notify_change for xattrs.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/24/5'}]
CVE State: PUBLISHED
Explain CVE-2015-1351
Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Affected Products: n/a
References: [{'name': '71929', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71929'}, {'name': '[oss-security] 20150124 Re: CVE Request: PHP', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2015/01/24/9'}, {'name': 'APPLE-SA-2015-09-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=68677'}, {'name': 'MDVSA-2015:079', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:079'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT205267'}, {'name': 'RHSA-2015:1053', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1053.html'}, {'name': 'GLSA-201606-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=777c39f4042327eac4b63c7ee87dc1c7a09a3115'}, {'name': 'RHSA-2015:1066', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1066.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1352
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=124fb22a13fafa3648e4e15b4f207c7096d8155e'}, {'name': '[oss-security] 20150124 Re: CVE Request: PHP', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2015/01/24/9'}, {'name': 'APPLE-SA-2015-09-30-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': 'MDVSA-2015:079', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:079'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html'}, {'name': 'SSRT102066', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=143403519711434&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT205267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=68741'}, {'name': '71932', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71932'}, {'name': 'RHSA-2015:1053', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1053.html'}, {'name': 'HPSBUX03337', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=143403519711434&w=2'}, {'name': 'GLSA-201606-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-10'}]
CVE State: PUBLISHED
Explain CVE-2015-1355
Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1356
Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1357
Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1358
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02'}, {'name': '72625', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72625'}, {'name': '1036090', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036090'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1359
Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/656463006'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/01/stable-update.html'}, {'name': 'GLSA-201502-13', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201502-13.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=421196'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=449894'}]
CVE State: PUBLISHED
Explain CVE-2015-1360
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/636233008'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/01/stable-update.html'}, {'name': 'GLSA-201502-13', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201502-13.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=416289'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=449894'}]
CVE State: PUBLISHED
Explain CVE-2015-1361
platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://src.chromium.org/viewvc/blink?view=revision&revision=183296'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/01/stable-update.html'}, {'name': 'GLSA-201502-13', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201502-13.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=411329'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=449894'}]
CVE State: PUBLISHED
Explain CVE-2015-1362
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130037/Exif-Pilot-4.7.2-Buffer-Overflow.html'}, {'name': '35870', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35870'}]
CVE State: PUBLISHED
Explain CVE-2015-1363
Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.itas.vn/news/itas-team-found-out-XSS-vulnerability-in-articlefr-cms-73.html'}, {'name': '20150122 XSS vulnerability in articleFR CMS 3.0.5', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/101'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130066/articleFR-CMS-3.0.5-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1364
SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
Affected Products: n/a
References: [{'name': '35857', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35857'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-articlefr-cms-72.html'}, {'name': '20150121 SQL injection vulnerability in articleFR CMS 3.0.5', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/81'}]
CVE State: PUBLISHED
Explain CVE-2015-1365
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Affected Products: n/a
References: [{'name': '20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/75'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php'}, {'name': 'pixarbay-wordpress-q-dir-traversal(100036)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100036'}, {'name': '117147', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/117147'}, {'name': '35846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35846'}, {'name': '20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534505/100/0/threaded'}, {'name': '[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/25/5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/pixabay-images/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2015-1366
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
Affected Products: n/a
References: [{'name': '20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/75'}, {'name': '73931', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73931'}, {'name': 'pixarbay-wordpress-authorlink-xss(100039)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100039'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php'}, {'name': '117144', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/117144'}, {'name': '35846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35846'}, {'name': '20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534505/100/0/threaded'}, {'name': '[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/25/5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1367
SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Affected Products: n/a
References: [{'name': '20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534490/100/0/threaded'}, {'name': '20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/63'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129990/CatBot-0.4.2-SQL-Injection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vulnerability-lab.com/get_content.php?id=1408'}, {'name': 'catbot-index-sql-injection(100043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100043'}]
CVE State: PUBLISHED
Explain CVE-2015-1368
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/.
Affected Products: n/a
References: [{'name': 'ansibletower-orderbynextrun-xss(99924)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99924'}, {'name': '116963', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116963'}, {'name': '116962', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116962'}, {'name': '116961', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116961'}, {'name': '72023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72023'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html'}, {'name': '20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534464/100/0/threaded'}, {'name': '116964', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116964'}, {'name': '116965', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116965'}, {'name': '20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/52'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt'}, {'name': '35786', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35786'}]
CVE State: PUBLISHED
Explain CVE-2015-1369
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/sequelize/sequelize/pull/2919'}, {'tags': ['x_refsource_MISC'], 'url': 'https://nodesecurity.io/advisories/sequelize-sql-injection-order'}, {'name': '[oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize  SQL Injection in Order', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/2'}]
CVE State: PUBLISHED
Explain CVE-2015-1370
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chjj/marked/issues/492'}, {'tags': ['x_refsource_MISC'], 'url': 'https://nodesecurity.io/advisories/marked_vbscript_injection'}, {'name': '[oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize  SQL Injection in Order', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba'}]
CVE State: PUBLISHED
Explain CVE-2015-1371
Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/JRogaishio/ferretCMS/issues/63'}, {'name': '72287', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72287'}, {'name': '[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html'}, {'name': '20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/98'}]
CVE State: PUBLISHED
Explain CVE-2015-1372
SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/JRogaishio/ferretCMS/issues/63'}, {'name': '72287', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72287'}, {'name': '[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html'}, {'name': '20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/98'}]
CVE State: PUBLISHED
Explain CVE-2015-1373
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/JRogaishio/ferretCMS/issues/63'}, {'name': '72287', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72287'}, {'name': '[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html'}, {'name': '20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/98'}]
CVE State: PUBLISHED
Explain CVE-2015-1374
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/JRogaishio/ferretCMS/issues/63'}, {'name': '[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/23/3'}]
CVE State: PUBLISHED
Explain CVE-2015-1375
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Affected Products: n/a
References: [{'name': '20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/75'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php'}, {'name': '117146', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/117146'}, {'name': '35846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35846'}, {'name': '20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534505/100/0/threaded'}, {'name': '[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/25/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1376
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Affected Products: n/a
References: [{'name': '20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/75'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php'}, {'name': '35846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35846'}, {'name': '20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534505/100/0/threaded'}, {'name': '[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/25/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1377
The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.webmin.com/security.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.webmin.com/changes.html'}, {'name': '62157', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62157'}]
CVE State: PUBLISHED
Explain CVE-2015-1378
cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2015-1378/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/grml/grml-debootstrap/issues/59'}, {'name': '[oss-security] 20150127 Re: CVE or not: 2x grml-debootstrap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/17'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cve.killedkenny.io/cve/CVE-2015-1378'}, {'tags': ['x_refsource_MISC'], 'url': 'https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1378.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1379
The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dest-unreach.org/socat/'}, {'name': '[oss-security] 20150406 Socat security advisory 6 - Possible DoS with fork (update: CVE-Id: CVE-2015-1379; fix for version 2)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/06/4'}, {'name': '72321', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72321'}, {'name': '[oss-security] 20150127 Re: Socat security advisory 6 - Possible DoS with fork', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1185711'}]
CVE State: PUBLISHED
Explain CVE-2015-1380
jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
Affected Products: n/a
References: [{'name': '[oss-security] 20150126 CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/26/4'}, {'name': '62899', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62899'}, {'name': '72355', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72355'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/currentjcc.c/?r1=1.433&r2=1.434'}, {'name': '[oss-security] 20150127 Re: CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/20'}, {'name': 'openSUSE-SU-2015:0230', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1381
Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20150126 CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/26/4'}, {'name': '62899', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62899'}, {'name': 'DSA-3145', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3145'}, {'name': '62775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47'}, {'name': '[oss-security] 20150127 Re: CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/20'}, {'name': 'openSUSE-SU-2015:0230', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1382
parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
Affected Products: n/a
References: [{'name': '[oss-security] 20150126 CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/26/4'}, {'name': '62899', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62899'}, {'name': 'DSA-3145', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3145'}, {'name': '62775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup'}, {'name': '[oss-security] 20150127 Re: CVE request for Privoxy', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/20'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298'}, {'name': 'openSUSE-SU-2015:0230', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1383
Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
Affected Products: n/a
References: [{'name': '20150128 Wordpress Geo Mashup plugin <= 1.8.2 XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/113'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/geo-mashup/changelog/'}, {'name': '[oss-security] 20150127 Re: CVE request: XSS in search functionality for Geo Mashup Wordpress plugin', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/26'}]
CVE State: PUBLISHED
Explain CVE-2015-1384
Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Affected Products: n/a
References: [{'name': '20150131 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534592/100/0/threaded'}, {'name': '20150201 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Feb/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/banner-effect-header/changelog/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.netsparker.com/cve-2015-1384-xss-vulnerability-in-banner-effect-header/'}]
CVE State: PUBLISHED
Explain CVE-2015-1385
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130155/Blubrry-PowerPress-6.0-Cross-Site-Scripting.html'}, {'name': '72362', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72362'}, {'name': '20150129 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534577/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/powerpress/changelog/'}, {'name': '20150130 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/130'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.netsparker.com/cve-2015-1385-xss-vulnerability-in-blubrry-powerpress/'}]
CVE State: PUBLISHED