Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-0556
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
Affected Products: n/a
References: [{'name': 'MDVSA-2015:201', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:201'}, {'name': 'FEDORA-2015-5546', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html'}, {'name': '[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/05/9'}, {'name': 'GLSA-201612-15', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-15'}, {'name': '[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/03/5'}, {'name': 'FEDORA-2015-5524', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html'}, {'name': '71860', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71860'}, {'name': 'DSA-3213', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3213'}, {'name': 'FEDORA-2015-5603', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434'}]
CVE State: PUBLISHED
Explain CVE-2015-0557
Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.
Affected Products: n/a
References: [{'name': 'MDVSA-2015:201', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:201'}, {'name': 'FEDORA-2015-5546', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html'}, {'name': '[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/05/9'}, {'name': 'GLSA-201612-15', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-15'}, {'name': '[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/03/5'}, {'name': 'FEDORA-2015-5524', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html'}, {'name': 'DSA-3213', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3213'}, {'name': 'FEDORA-2015-5603', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html'}, {'name': '71895', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71895'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435'}]
CVE State: PUBLISHED
Explain CVE-2015-0558
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC address to generate the WPA key.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129817/Pirelli-Router-P.DG-A4001N-WPA-Key-Reverse-Engineering.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.exploit-db.com/exploits/35721'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99682'}]
CVE State: PUBLISHED
Explain CVE-2015-0559
Multiple use-after-free vulnerabilities in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory.
Affected Products: n/a
References: [{'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10720'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e843c6797db98bfceab382d5d7e76727e1014f5e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-01.html'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0560
The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Affected Products: n/a
References: [{'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10806'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a442a1c0e815fd61416cf408bd74d85a042ccc6a'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-01.html'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0561
asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10773'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-02.html'}, {'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8e96830156bea314207b97315ccebd605317f142'}]
CVE State: PUBLISHED
Explain CVE-2015-0562
Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0019.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a559f2a050947f793c00159c0cd4d30f403f217c'}, {'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'name': 'MDVSA-2015:022', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:022'}, {'name': '71921', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71921'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'RHSA-2015:1460', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1460.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10724'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html'}, {'name': 'DSA-3141', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3141'}, {'name': '62673', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62673'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-03.html'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0563
epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0019.html'}, {'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'name': 'MDVSA-2015:022', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:022'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10823'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=611cfd00c283e7a77a2f1fd89c01b0b9f691411b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html'}, {'name': '71916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71916'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-04.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=854157883bd1972e012c65c0418a9732ef5d9fb0'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0564
Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0019.html'}, {'name': '62612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62612'}, {'name': 'MDVSA-2015:022', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:022'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'RHSA-2015:1460', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1460.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2015-05.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html'}, {'name': 'DSA-3141', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3141'}, {'name': '62673', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62673'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d3581aecda62d2a51ea7088fd46975415b03ec57'}, {'name': '71922', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71922'}, {'name': 'openSUSE-SU-2015:0113', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0565
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Affected Products: NaCL
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/36310/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/36311/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0568
Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/projects/security-advisories/multiple-issues-camera-drivers-cve-2014-9410-cve-2015-0568'}, {'name': '92379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92379'}]
CVE State: PUBLISHED
Explain CVE-2015-0569
Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.android.com/security/bulletin/2016-05-01.html'}, {'name': '77691', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/77691'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015'}, {'name': '39308', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39308/'}]
CVE State: PUBLISHED
Explain CVE-2015-0570
Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.android.com/security/bulletin/2016-05-01.html'}, {'name': '77691', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/77691'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015'}]
CVE State: PUBLISHED
Explain CVE-2015-0571
The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.android.com/security/bulletin/2016-05-01.html'}, {'name': '77691', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/77691'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015'}]
CVE State: PUBLISHED
Explain CVE-2015-0572
Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=8fb32c3a8147b82e2bb159b3f70d803c9e68899b'}, {'name': '93312', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/93312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/race-condition-leading-arbitrary-null-write-adsp-using-ioctl-compatfastrpcioctlinvokefd-cve-2015'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.android.com/security/bulletin/2016-10-01.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61'}]
CVE State: PUBLISHED
Explain CVE-2015-0573
drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442'}]
CVE State: PUBLISHED
Explain CVE-2015-0574
In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient.
Affected Products: Snapdragon Mobile, Snapdragon Wear
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-07-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2018-04-01'}, {'name': '103671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103671'}]
CVE State: PUBLISHED
Explain CVE-2015-0575
In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration.
Affected Products: All Qualcomm products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-07-01'}, {'name': '99467', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99467'}]
CVE State: PUBLISHED
Explain CVE-2015-0576
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in HSDPA.
Affected Products: Snapdragon Mobile, Snapdragon Wear
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-07-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2018-04-01'}, {'name': '103671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103671'}]
CVE State: PUBLISHED
Explain CVE-2015-0577
Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA), allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCus22925 and CSCup08113.
Affected Products: n/a
References: [{'name': '62289', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62289'}, {'name': '20150113 Cisco AsyncOS ISQ XSS Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0577'}, {'name': 'cisco-asyncos-cve20150577-xss(100556)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100556'}, {'name': '1031544', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031544'}, {'name': '72056', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72056'}]
CVE State: PUBLISHED
Explain CVE-2015-0578
Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
Affected Products: n/a
References: [{'name': '1031542', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031542'}, {'name': 'cisco-asa-cve20150578-dos(100549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100549'}, {'name': '20150115 Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/viewAlert.x?alertId=37022'}, {'name': '72718', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72718'}, {'name': '20150114 Cisco ASA DHCPv6 Relay DoS Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0578'}]
CVE State: PUBLISHED
Explain CVE-2015-0579
Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473.
Affected Products: n/a
References: [{'name': '20150115 Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/viewAlert.x?alertId=37007'}, {'name': '72057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72057'}, {'name': '1031541', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031541'}, {'name': '20150113 Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0579'}]
CVE State: PUBLISHED
Explain CVE-2015-0580
Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027.
Affected Products: n/a
References: [{'name': '20150211 Cisco Secure Access Control System SQL Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150211-csacs'}, {'name': 'cisco-acs-cve20150580-sql-injection(100812)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100812'}, {'name': '72576', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72576'}, {'name': '1031740', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031740'}]
CVE State: PUBLISHED
Explain CVE-2015-0581
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.
Affected Products: n/a
References: [{'name': '20150128 Cisco Prime Service Catalog XML External Entity Processing Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-psc-xmlee'}, {'name': '72350', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72350'}, {'name': '1031658', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031658'}]
CVE State: PUBLISHED
Explain CVE-2015-0582
The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic, aka Bug ID CSCuo09129.
Affected Products: n/a
References: [{'name': '20150109 Cisco MDS 9000 Series Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0582'}, {'name': '71979', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71979'}, {'name': 'cisco-nxos-cve20150582-dos(99995)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99995'}, {'name': '1031539', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031539'}]
CVE State: PUBLISHED
Explain CVE-2015-0583
Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
Affected Products: n/a
References: [{'name': '72012', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72012'}, {'name': 'cisco-webex-cve20150583-info-disc(100565)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100565'}, {'name': '20150112 Cisco WebEx Meetings Server Information Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0583'}]
CVE State: PUBLISHED
Explain CVE-2015-0584
The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter, aka Bug ID CSCus38947.
Affected Products: n/a
References: [{'name': '72696', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72696'}, {'name': '20150219 Cisco Collaboration Desk Experience Endpoints Command Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0584'}]
CVE State: PUBLISHED
Explain CVE-2015-0586
The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.
Affected Products: n/a
References: [{'name': '20150126 Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0586'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37171'}, {'name': '1031659', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031659'}, {'name': '72309', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72309'}, {'name': 'cisco-2900series-cve20150586-dos(100660)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100660'}]
CVE State: PUBLISHED
Explain CVE-2015-0588
Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.
Affected Products: n/a
References: [{'name': '1031559', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031559'}, {'name': '20150115 Cisco Unified Communications Domain Manager Cross-Site Request Forgery Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0588'}, {'name': '62352', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62352'}, {'name': 'cisco-ucdm-cve20150588-csrf(100657)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100657'}, {'name': '72082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72082'}]
CVE State: PUBLISHED
Explain CVE-2015-0589
The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460.
Affected Products: n/a
References: [{'name': '1031692', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031692'}, {'name': '62799', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62799'}, {'name': 'cisco-webex-cve20150589-command-exec(100719)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100719'}, {'name': '20150204 Cisco WebEx Meetings Server Command Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx'}, {'name': '72493', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72493'}]
CVE State: PUBLISHED
Explain CVE-2015-0590
Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165.
Affected Products: n/a
References: [{'name': '20150115 Cisco Hosted WebEx Meeting Center Information Disclosure', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0590'}, {'name': '1031558', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031558'}, {'name': 'cisco-webexmc-cve20150590-info-disc(100576)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100576'}]
CVE State: PUBLISHED
Explain CVE-2015-0591
Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets, aka Bug ID CSCur44177.
Affected Products: n/a
References: [{'name': '20150115 Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0591'}, {'name': '72084', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72084'}, {'name': '1031561', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031561'}, {'name': 'cisco-ucdm-cve20150591-dos(100661)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100661'}]
CVE State: PUBLISHED
Explain CVE-2015-0592
The Zone-Based Firewall implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers incorrect kernel-timer handling, aka Bug ID CSCuh25672.
Affected Products: n/a
References: [{'name': 'ciscoios-cve20150592-dos(100758)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100758'}, {'name': '20150209 Cisco IOS Software Kernel Timer Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0592'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37416'}, {'name': '1031713', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031713'}]
CVE State: PUBLISHED
Explain CVE-2015-0593
The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37417'}, {'name': '20150209 Cisco IOS Software Zone-Based Firewall Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0593'}, {'name': 'ciscoios-cve20150593-dos(100757)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100757'}, {'name': '72549', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72549'}]
CVE State: PUBLISHED
Explain CVE-2015-0594
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun18263.
Affected Products: n/a
References: [{'name': '1031813', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031813'}, {'name': '1031814', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031814'}, {'name': '20150226 Cisco Common Services Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0594'}, {'name': '72793', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72793'}]
CVE State: PUBLISHED
Explain CVE-2015-0595
The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079.
Affected Products: n/a
References: [{'name': '1031676', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031676'}, {'name': 'cisco-webex-cve20150595-info-disc(100667)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100667'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37238'}, {'name': '62686', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62686'}, {'name': '72370', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72370'}, {'name': '20150129 Cisco WebEx Meetings Server XMLAPI Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0595'}]
CVE State: PUBLISHED
Explain CVE-2015-0596
Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163.
Affected Products: n/a
References: [{'name': '1031677', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031677'}, {'name': '61797', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61797'}, {'name': '72371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72371'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37239'}, {'name': 'cisco-webex-cve20150596-csrf(100665)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100665'}, {'name': '20150129 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0596'}]
CVE State: PUBLISHED
Explain CVE-2015-0597
The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
Affected Products: n/a
References: [{'name': 'cisco-webex-cve20150597-info-disc(100658)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100658'}, {'name': '20150129 Cisco WebEx Meetings Server User Enumeration Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37240'}, {'name': '72373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72373'}, {'name': '1031678', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031678'}]
CVE State: PUBLISHED
Explain CVE-2015-0598
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.
Affected Products: n/a
References: [{'name': '1031842', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031842'}, {'name': '20150305 Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0598'}]
CVE State: PUBLISHED
Explain CVE-2015-0599
The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138.
Affected Products: n/a
References: [{'name': 'cisco-ucs-cve20150599-xfs(100614)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100614'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37324'}, {'name': '20150202 Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0599'}, {'name': '62762', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62762'}, {'name': '72509', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72509'}]
CVE State: PUBLISHED
Explain CVE-2015-0600
The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139.
Affected Products: n/a
References: [{'name': '20150203 Cisco Unified IP Phone 9900 Series Mobility Extension Availability Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0600'}, {'name': 'cisco-ipphones-cve20150600-dos(100726)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100726'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37341'}, {'name': '72481', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72481'}]
CVE State: PUBLISHED
Explain CVE-2015-0601
Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790.
Affected Products: n/a
References: [{'name': 'cisco-unifiedipphone-cve20150601-dos(100617)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100617'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37344'}, {'name': '20150203 Cisco Unified IP Phone 9900 Series Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0601'}, {'name': '72483', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72483'}]
CVE State: PUBLISHED
Explain CVE-2015-0602
The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to obtain sensitive information by sniffing the network, aka Bug ID CSCuq12117.
Affected Products: n/a
References: [{'name': 'cisco-unifiedipphone-cve20150602-info-disc(100615)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100615'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37342'}, {'name': '72482', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72482'}, {'name': '20150203 Cisco Unified IP Phone 9900 Series Data Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0602'}]
CVE State: PUBLISHED
Explain CVE-2015-0603
Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files, which allows local users to cause a denial of service (persistent hang or reboot) by writing to a phone's filesystem, aka Bug ID CSCup90474.
Affected Products: n/a
References: [{'name': '72484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72484'}, {'name': '20150203 Cisco Unified IP Phone 9900 Series Insecure Device Permissions Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0603'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37345'}, {'name': 'cisco-unifiedipphone-cve20150603-dos(100619)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100619'}]
CVE State: PUBLISHED
Explain CVE-2015-0604
The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424.
Affected Products: n/a
References: [{'name': 'cisco-unifiedipphone-cve20150604-file-upload(100620)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100620'}, {'name': '20150203 Cisco Unified IP Phone 9900 Series Arbitrary File Upload Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0604'}, {'name': '62761', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62761'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37346'}, {'name': '72485', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72485'}]
CVE State: PUBLISHED
Explain CVE-2015-0605
The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343.
Affected Products: n/a
References: [{'name': '72528', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72528'}, {'name': '62829', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62829'}, {'name': '20150206 Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0605'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37384'}, {'name': 'cisco-asyncos-cve20150605-sec-bypass(100695)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100695'}]
CVE State: PUBLISHED
Explain CVE-2015-0606
The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696.
Affected Products: n/a
References: [{'name': '20150210 Cisco IOS Shell Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0606'}, {'name': '72550', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72550'}, {'name': '1031717', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031717'}, {'name': 'ciscoios-cve20150606-dos(100810)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100810'}]
CVE State: PUBLISHED
Explain CVE-2015-0607
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.
Affected Products: n/a
References: [{'name': '72794', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72794'}, {'name': '1031817', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031817'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tools.cisco.com/security/center/viewAlert.x?alertId=37711'}, {'name': '20150226 Cisco IOS Software Authentication Proxy Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0607'}]
CVE State: PUBLISHED