Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1847
Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://appserver.io/security/2015/03/31/traversal-directory-vulnerability-in-webserver.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1848
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Affected Products: n/a
References: [{'name': 'RHSA-2015:0990', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0990.html'}, {'name': 'FEDORA-2015-8761', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=1009855'}, {'name': 'RHSA-2015:0980', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0980.html'}, {'name': 'FEDORA-2015-8765', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html'}, {'name': 'FEDORA-2015-8788', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html'}, {'name': '74623', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74623'}]
CVE State: PUBLISHED
Explain CVE-2015-1849
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/wildfly-security/jboss-negotiation/pull/21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1208580'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1199641'}]
CVE State: PUBLISHED
Explain CVE-2015-1851
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Affected Products: n/a
References: [{'name': '[openstack-announce] 20150616 [OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html'}, {'name': 'DSA-3292', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3292'}, {'name': '[oss-security] 20150613 CVE-2015-1850: OpenStack Cinder/Nova: Format-guessing and file disclosure in image convert', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/06/13/1'}, {'name': '[oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/06/17/7'}, {'name': 'RHSA-2015:1206', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1206.html'}, {'name': 'USN-2703-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2703-1'}, {'name': '[oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/06/17/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/cinder/+bug/1415087'}]
CVE State: PUBLISHED
Explain CVE-2015-1852
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
Affected Products: n/a
References: [{'name': 'USN-2705-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2705-1'}, {'name': '[openstack-announce] 20150414 [OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/keystonemiddleware/+bug/1411063'}, {'name': 'RHSA-2015:1685', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1685.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': '74187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74187'}, {'name': 'RHSA-2015:1677', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1677.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1853
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
Affected Products: chrony
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security.gentoo.org/glsa/201507-01'}, {'tags': ['x_refsource_MISC'], 'url': 'http://chrony.tuxfamily.org/News.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1854
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Affected Products: n/a
References: [{'name': '74392', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74392'}, {'name': 'RHSA-2015:0895', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2015:0895'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1209573'}, {'name': '[debian-lts-announce] 20180715 [SECURITY] [DLA 1428-1] 389-ds-base security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html'}, {'name': 'FEDORA-2015-7206', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157069.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1855
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Affected Products: Ruby
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3247'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3245'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3246'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://puppetlabs.com/security/cve/cve-2015-1855'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.ruby-lang.org/issues/9644'}]
CVE State: PUBLISHED
Explain CVE-2015-1856
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1845', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1845.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/swift/+bug/1430645'}, {'name': 'SUSE-SU-2015:1846', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html'}, {'name': 'RHSA-2015:1846', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1846.html'}, {'name': 'RHSA-2015:1681', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1681.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'USN-2704-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2704-1'}, {'name': '74182', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74182'}, {'name': 'FEDORA-2015-12245', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163113.html'}, {'name': '[openstack-announce] 20150414 [OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openstack.org/pipermail/openstack-announce/2015-April/000349.html'}, {'name': 'RHSA-2015:1684', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1684.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1857
The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.opendaylight.org/gerrit/#/c/17709/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.opendaylight.org/view/Security_Advisories'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cloudrouter.org/security/'}]
CVE State: PUBLISHED
Explain CVE-2015-1858
Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-6114', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html'}, {'name': 'FEDORA-2015-6123', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html'}, {'name': 'GLSA-201603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-10'}, {'name': 'FEDORA-2015-6315', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.qt-project.org/#/c/108312/'}, {'name': 'FEDORA-2015-6364', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.html'}, {'name': 'USN-2626-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2626-1'}, {'name': '[Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.qt-project.org/pipermail/announce/2015-April/000067.html'}, {'name': '74309', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74309'}, {'name': 'FEDORA-2015-6252', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1859
Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-6114', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html'}, {'name': '74307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74307'}, {'name': 'FEDORA-2015-6123', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html'}, {'name': '74310', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74310'}, {'name': 'GLSA-201603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-10'}, {'name': 'FEDORA-2015-6315', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html'}, {'name': 'FEDORA-2015-6364', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.html'}, {'name': 'USN-2626-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2626-1'}, {'name': '[Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.qt-project.org/pipermail/announce/2015-April/000067.html'}, {'name': 'FEDORA-2015-6252', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1860
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-6114', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html'}, {'name': 'FEDORA-2015-6573', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156937.html'}, {'name': 'FEDORA-2015-6123', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html'}, {'name': 'GLSA-201603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-10'}, {'name': 'FEDORA-2015-6315', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html'}, {'name': 'FEDORA-2015-6613', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155947.html'}, {'name': '74302', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74302'}, {'name': 'FEDORA-2015-6364', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.html'}, {'name': 'FEDORA-2015-6661', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156761.html'}, {'name': 'USN-2626-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2626-1'}, {'name': '[Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.qt-project.org/pipermail/announce/2015-April/000067.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.qt-project.org/#/c/108248/'}, {'name': 'FEDORA-2015-6252', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1862
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1211223'}, {'name': '[oss-security] 20150414 Problems in automatic crash analysis frameworks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/14/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131422/Fedora-abrt-Race-Condition.html'}, {'name': '36746', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36746/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131429/Abrt-Apport-Race-Condition-Symlink.html'}, {'name': '74263', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74263'}, {'name': '36747', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36747/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/abrt/pull/810'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131423/Linux-Apport-Abrt-Local-Root-Exploit.html'}, {'name': '20150414 Problems in automatic crash analysis frameworks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Apr/34'}]
CVE State: PUBLISHED
Explain CVE-2015-1863
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt'}, {'name': 'DSA-3233', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3233'}, {'name': '20150423 [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/535353/100/0/threaded'}, {'name': 'USN-2577-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2577-1'}, {'name': 'openSUSE-SU-2015:0813', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00000.html'}, {'name': '20150424 [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Apr/82'}, {'name': '74296', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74296'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131598/Android-wpa_supplicant-Heap-Overflow.html'}, {'name': 'GLSA-201606-17', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-17'}, {'name': '1032192', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032192'}, {'name': 'RHSA-2015:1090', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1090.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1864
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kallithea-scm.org/security/cve-2015-1864.html'}, {'name': '74184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74184'}, {'name': '[oss-security] 20150414 CVE-2015-1864: Multiple HTML and Javascript injections', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/14/12'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55'}]
CVE State: PUBLISHED
Explain CVE-2015-1865
fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Affected Products: n/a
References: [{'name': '76073', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76073'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1211300'}]
CVE State: PUBLISHED
Explain CVE-2015-1866
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://emberjs.com/blog/2015/04/14/security-and-bugfix-releases-ember-1-10-1-1-11-2-1-11-3.html'}, {'name': '[oss-security] 20150414 [CVE-2015-1866] Ember.js XSS Vulnerability With {{view', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/14/11'}, {'name': '74185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74185'}]
CVE State: PUBLISHED
Explain CVE-2015-1867
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-f9864ecd8f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169995.html'}, {'name': 'RHSA-2015:1424', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1424.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pacemaker/commit/84ac07c'}, {'name': 'FEDORA-2015-e5e36bbb87', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170610.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1211370'}, {'name': 'GLSA-201710-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201710-08'}, {'name': '74231', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74231'}, {'name': 'RHSA-2015:2383', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-2383.html'}, {'name': 'FEDORA-2015-f6860d8f9d', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169671.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1868
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-7079', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html'}, {'name': 'FEDORA-2015-7031', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.html'}, {'name': 'FEDORA-2015-7018', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.html'}, {'name': '74306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74306'}, {'name': 'FEDORA-2015-7033', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.html'}, {'name': 'FEDORA-2015-7047', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.html'}, {'name': 'DSA-3306', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3306'}, {'name': 'DSA-3307', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3307'}, {'name': '1032220', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032220'}, {'name': 'FEDORA-2015-7057', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1869
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Affected Products: ABRT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/04/17/5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1212861'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/abrt/commit/3287aa12eb205cff95cdd00d6d6c5c9a4f8f0eca'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/abrt/commit/7417505e1d93cc95ec648b74e3c801bc67aacb9f'}]
CVE State: PUBLISHED
Explain CVE-2015-1870
The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1083.html'}, {'name': '75119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75119'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1'}, {'name': 'RHSA-2015:1210', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1210.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1212868'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7c'}]
CVE State: PUBLISHED
Explain CVE-2015-1872
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=fabbfaa095660982cc0bc63242c459561fa37037'}, {'name': 'USN-2944-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2944-1'}, {'name': '1033078', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033078'}, {'name': '72644', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72644'}, {'name': '[debian-lts-announce] 20190330 [SECURITY] [DLA 1740-1] libav security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1874
Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
Affected Products: n/a
References: [{'name': '72964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72964'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130654/WordPress-Contact-Form-DB-2.8.29-Cross-Site-Request-Forgery.html'}, {'name': '20150304 CSRF in Contact Form DB allows attacker to delete all stored form submissions (WordPress plugin)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Mar/21'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/contact-form-7-to-database-extension/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2015-1875
SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter.
Affected Products: n/a
References: [{'name': '36305', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36305/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130698/Elastix-2.5.0-SQL-Injection.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1876
Directory traversal vulnerability in ES File Explorer 3.2.4.1.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130431/ES-File-Explorer-3.2.4.1-Path-Traversal.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1877
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=89129'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/02/18/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/02/18/9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777722'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.debian.org/security/2015/dsa-3165'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/72675'}]
CVE State: PUBLISHED
Explain CVE-2015-1878
Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.
Affected Products: n/a
References: [{'name': '1032152', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032152'}]
CVE State: PUBLISHED
Explain CVE-2015-1879
Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
Affected Products: n/a
References: [{'name': '72547', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72547'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/google-document-embedder/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2015-1880
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '1032261', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032261'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-15-005/'}, {'name': '74652', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74652'}, {'name': '1032265', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032265'}, {'name': '1032264', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032264'}, {'name': '1032262', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032262'}]
CVE State: PUBLISHED
Explain CVE-2015-1881
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.
Affected Products: n/a
References: [{'name': '[openstack-announce] 20150223 [OSSA 2015-004] Glance import task leaks image in backend (CVE-2014-9684, CVE-2015-1881)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html'}, {'name': 'RHSA-2015:0938', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0938.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/glance/+bug/1420696'}, {'name': '72694', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72694'}]
CVE State: PUBLISHED
Explain CVE-2015-1882
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
Affected Products: n/a
References: [{'name': '74222', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74222'}, {'name': '1032190', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032190'}, {'name': 'PI33357', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21697368'}]
CVE State: PUBLISHED
Explain CVE-2015-1883
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21698308'}, {'name': '75946', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75946'}, {'name': 'IT08085', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IT08085'}, {'name': 'IT08080', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IT08080'}, {'name': 'IT08086', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IT08086'}, {'name': '1032881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032881'}, {'name': 'IT08075', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IT08075'}]
CVE State: PUBLISHED
Explain CVE-2015-1884
Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
Affected Products: n/a
References: [{'name': '1032700', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032700'}, {'name': 'JR52957', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957'}, {'name': '1032701', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032701'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700831'}, {'name': '75360', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75360'}]
CVE State: PUBLISHED
Explain CVE-2015-1885
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21963275'}, {'name': 'PI33202', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI33202'}, {'name': '1032190', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032190'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21697368'}, {'name': '74219', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74219'}, {'name': 'PI36211', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI36211'}]
CVE State: PUBLISHED
Explain CVE-2015-1886
The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Affected Products: n/a
References: [{'name': 'PI37356', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI37356'}, {'name': '1032189', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032189'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21701566'}, {'name': '74216', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74216'}]
CVE State: PUBLISHED
Explain CVE-2015-1887
IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a crafted request.
Affected Products: n/a
References: [{'name': '1032970', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032970'}, {'name': '75475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75475'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21958024'}, {'name': 'PI36150', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI36150'}]
CVE State: PUBLISHED
Explain CVE-2015-1888
Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700205'}]
CVE State: PUBLISHED
Explain CVE-2015-1889
The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure.
Affected Products: n/a
References: [{'name': '1032150', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700654'}]
CVE State: PUBLISHED
Explain CVE-2015-1890
/usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys, and lacks a warning about reviewing this archive to detect included keys, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
Affected Products: n/a
References: [{'name': '73918', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73918'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg3T1022077'}]
CVE State: PUBLISHED
Explain CVE-2015-1892
The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.
Affected Products: n/a
References: [{'name': '73683', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73683'}, {'name': 'VU#550620', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/550620'}, {'name': 'IV70911', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV70911'}, {'name': 'IV70913', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IV70913'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21699497'}]
CVE State: PUBLISHED
Explain CVE-2015-1893
The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors.
Affected Products: n/a
References: [{'name': '1032025', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032025'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21701337'}, {'name': '73916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73916'}, {'name': 'IT07841', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1IT07841'}]
CVE State: PUBLISHED
Explain CVE-2015-1894
Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Affected Products: n/a
References: [{'name': '74441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700768'}]
CVE State: PUBLISHED
Explain CVE-2015-1895
IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 relies on client-side code to verify authorization, which allows remote attackers to bypass intended access restrictions by modifying the client behavior.
Affected Products: n/a
References: [{'name': '74442', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74442'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700768'}]
CVE State: PUBLISHED
Explain CVE-2015-1896
Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700536'}, {'name': '20150410 IBM Tivoli Storage Manager FastBackMount " GetValByKey" Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1093'}, {'name': '74024', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74024'}]
CVE State: PUBLISHED
Explain CVE-2015-1897
Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1898.
Affected Products: n/a
References: [{'name': '1032102', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032102'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700057'}, {'name': '20150410 IBM Tivoli Storage Manager FastBackMount "Insecure sprintf Use" Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1092'}]
CVE State: PUBLISHED
Explain CVE-2015-1898
Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1897.
Affected Products: n/a
References: [{'name': '1032102', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032102'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700539'}, {'name': '20150410 IBM Tivoli Storage Manager FastBackMount "Insecure sscanf Use" Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1091'}, {'name': '74036', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74036'}]
CVE State: PUBLISHED
Explain CVE-2015-1899
IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'PI37139', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PI37139'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21700066'}]
CVE State: PUBLISHED