Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1958
Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.imagemagick.org/changeset/14801'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/13/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ubuntu.com/usn/usn-2132-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.openwall.com/lists/oss-security/2014/02/19/13'}]
CVE State: PUBLISHED
Explain CVE-2014-1959
lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gnutls.org/security.html'}, {'name': '[oss-security] 20140213 CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/344'}, {'name': '[oss-security] 20140213 Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/345'}, {'name': '65559', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65559'}, {'name': 'USN-2121-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2121-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.gitorious.org/gnutls/gnutls/commit/b1abfe3d182d68539900092eb42fc62cf1bb7e7c'}, {'name': 'DSA-2866', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2866'}]
CVE State: PUBLISHED
Explain CVE-2014-1960
The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1828885'}, {'name': 'netweaver-solution-info-disc(91093)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91093'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://scn.sap.com/docs/DOC-8218'}, {'name': '56942', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56942'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-004-sap-netweaver-solution-manager-missing-authorization-check-information-disclosure/'}]
CVE State: PUBLISHED
Explain CVE-2014-1961
Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors.
Affected Products: n/a
References: [{'name': '56947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56947'}, {'name': 'netweaver-webdyn-path-disclosure(91096)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91096'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://scn.sap.com/docs/DOC-8218'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1852146'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-002-sap-portal-webdynpro-path-disclosure/'}]
CVE State: PUBLISHED
Explain CVE-2014-1962
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-003-sap-crm-gwsync-xxe/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1917054'}, {'name': 'sap-crm-info-disc(91098)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91098'}, {'name': '56944', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56944'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://scn.sap.com/docs/DOC-8218'}]
CVE State: PUBLISHED
Explain CVE-2014-1963
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.
Affected Products: n/a
References: [{'name': 'netweaver-message-server-dos(91097)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91097'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1773912'}, {'name': '56947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56947'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://scn.sap.com/docs/DOC-8218'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-001-sap-netweaver-message-server-dos/'}]
CVE State: PUBLISHED
Explain CVE-2014-1964
Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1788080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-005-sap-netweaver-dir-error-xss/'}, {'name': '56947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56947'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://scn.sap.com/docs/DOC-8218'}, {'name': 'netweaver-dir-xss(91095)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91095'}]
CVE State: PUBLISHED
Explain CVE-2014-1965
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.
Affected Products: n/a
References: [{'name': 'netweaver-ispeakadapter-xss(91094)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91094'}, {'name': '56947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56947'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-14-006-sap-netweaver-pip-xss/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.sap.com/sap/support/notes/1442517'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517'}]
CVE State: PUBLISHED
Explain CVE-2014-1966
The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (device outage) via crafted packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892342.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ics-cert.us-cert.gov/advisories/ICSA-14-051-03'}]
CVE State: PUBLISHED
Explain CVE-2014-1967
The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=jp.denimoba'}, {'name': 'JVNDB-2014-000022', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000022'}, {'name': 'JVN#48810179', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN48810179/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1968
Cross-site scripting (XSS) vulnerability in the XooNIps module 3.47 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#87797318', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN87797318/index.html'}, {'name': 'JVNDB-2014-000025', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000025'}, {'name': '65807', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65807'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xoonips.sourceforge.jp'}]
CVE State: PUBLISHED
Explain CVE-2014-1969
Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000035', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000035'}, {'name': 'JVN#47386847', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN47386847/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1970
Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#70029459', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN70029459/index.html'}, {'name': 'JVNDB-2014-000033', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000033'}]
CVE State: PUBLISHED
Explain CVE-2014-1971
Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#14282890', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14282890/index.html'}, {'name': '66329', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66329'}, {'name': 'JVNDB-2014-000032', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/silexlabs/Silex/blob/master/docs/change-log.md'}]
CVE State: PUBLISHED
Explain CVE-2014-1972
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://tapestry.apache.org/release-notes-536.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/TAP5-2008'}, {'name': 'JVN#17611367', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN17611367/index.html'}, {'name': 'JVNDB-2015-000118', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000118'}, {'name': '[oss-security] 20190823 CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2019/08/23/5'}, {'name': '20190825 CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Aug/20'}, {'name': '[tapestry-users] 20190913 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/84e99dedad2ecb4676de93c3ab73a8a10882951ab6984f514707f3d9%40%3Cusers.tapestry.apache.org%3E'}, {'name': '[tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E'}, {'name': '[tapestry-commits] 20200111 svn commit: r1055136 [2/2] - in /websites/production/tapestry/content: cache/main.pageCache component-rendering.html content-type-and-markup.html dom.html https.html request-processing.html response-compression.html security.html url-rewriting.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E'}, {'name': '[tapestry-commits] 20200531 svn commit: r1061326 [4/4] - in /websites/production/tapestry/content: ./ cache/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2014-1973
Directory traversal vulnerability in the NextApp File Explorer application before 2.1.0.3 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
Affected Products: n/a
References: [{'name': '68726', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/68726'}, {'name': 'JVN#84335912', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN84335912/index.html'}, {'name': 'JVNDB-2014-000081', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000081'}]
CVE State: PUBLISHED
Explain CVE-2014-1974
Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=lysesoft.andexplorer'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=lysesoft.andexplorerpro'}, {'name': 'JVN#22670349', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN22670349/index.html'}, {'name': 'JVNDB-2014-000037', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000037'}]
CVE State: PUBLISHED
Explain CVE-2014-1975
Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000031', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN38227002/995495/index.html'}, {'name': 'JVN#38227002', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN38227002/index.html'}, {'name': '66250', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66250'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=org.rhorita777.unzipper'}]
CVE State: PUBLISHED
Explain CVE-2014-1976
The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000030', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000030'}, {'name': 'JVN#16263849', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN16263849/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://play.google.com/store/apps/details?id=com.demaecan.androidapp'}]
CVE State: PUBLISHED
Explain CVE-2014-1977
The NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier for Android 4.1 through 4.4 uses weak permissions for attachments during processing of incoming e-mail messages, which allows attackers to obtain sensitive information via a crafted application.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000027', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000027'}, {'name': 'JVN#81739241', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN81739241/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1978
The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted application.
Affected Products: n/a
References: [{'name': 'JVN#05951929', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN05951929/index.html'}, {'name': 'JVNDB-2014-000028', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000028'}]
CVE State: PUBLISHED
Explain CVE-2014-1979
The NTT DOCOMO sp mode mail application 5900 through 6300 for Android 4.0.x and 6000 through 6620 for Android 4.1 through 4.4 allows remote attackers to execute arbitrary Java methods via Deco-mail emoticon POP data in an e-mail message.
Affected Products: n/a
References: [{'name': 'JVN#89260331', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN89260331/index.html'}, {'name': 'JVNDB-2014-000029', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000029'}]
CVE State: PUBLISHED
Explain CVE-2014-1980
Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
Affected Products: n/a
References: [{'name': 'JVN#80310172', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN80310172/index.html'}, {'name': 'JVNDB-2014-000092', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000092'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwigo.org/bugs/view.php?id=2805'}]
CVE State: PUBLISHED
Explain CVE-2014-1982
The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
Affected Products: n/a
References: [{'name': '32545', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/32545'}, {'name': '20140326 [GTA-2014-01] - Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell.', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Mar/340'}]
CVE State: PUBLISHED
Explain CVE-2014-1983
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.
Affected Products: n/a
References: [{'name': 'JVN#10319260', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN10319260/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/20130317notice01.php'}, {'name': 'JVNDB-2014-000039', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000039'}]
CVE State: PUBLISHED
Explain CVE-2014-1984
Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/20130317notice02.php'}, {'name': 'JVNDB-2014-000040', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040'}, {'name': 'JVN#00058727', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00058727/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1985
Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000041', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000041.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.redmine.org/projects/redmine/wiki/Changelog'}, {'name': 'JVN#93004610', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93004610/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3'}, {'name': '[oss-security] 20140410 Re: CVE request: redmine open redirector', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q2/84'}, {'name': '66674', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66674'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.redmine.org/projects/redmine/wiki/Security_Advisories'}, {'name': '57524', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57524'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.redmine.org/projects/redmine/wiki/Changelog_2_4'}]
CVE State: PUBLISHED
Explain CVE-2014-1986
The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application.
Affected Products: n/a
References: [{'name': 'JVN#55438786', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55438786/index.html'}, {'name': 'JVNDB-2014-000036', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000036'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://play.google.com/store/apps/details?id=jp.co.kokuyost.CamiApp'}]
CVE State: PUBLISHED
Explain CVE-2014-1987
The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000073', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000073'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140421news01.php'}, {'name': 'JVN#42024228', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN42024228/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1988
The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000042', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000042'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8105'}, {'name': 'JVN#90519014', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN90519014/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1989
Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja/article/5264'}, {'name': 'JVN#31230946', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN31230946/index.html'}, {'name': 'JVNDB-2014-000043', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043'}]
CVE State: PUBLISHED
Explain CVE-2014-1990
Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.toshibatec.co.jp/page.jsp?id=4224'}, {'name': 'JVNDB-2014-000038', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000038'}, {'name': 'JVN#13313061', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN13313061/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1991
Open redirect vulnerability in WebPlatform / AppFramework 6.0 through 7.2 in NTT DATA INTRAMART intra-mart allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#68340046', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN68340046/index.html'}, {'name': 'JVNDB-2014-000044', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN68340046/278948/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1992
Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140714up05.php'}, {'name': 'JVNDB-2014-000078', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000078'}, {'name': 'JVN#94838679', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN94838679/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1993
The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140714up04.php'}, {'name': 'JVNDB-2014-000077', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000077'}, {'name': 'JVN#75990997', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN75990997/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1994
Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#80583739', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN80583739/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140714up04.php'}, {'name': 'JVNDB-2014-000076', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000076'}]
CVE State: PUBLISHED
Explain CVE-2014-1995
Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140714up02.php'}, {'name': 'JVNDB-2014-000075', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000075'}, {'name': 'JVN#97558950', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN97558950/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1996
Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
Affected Products: n/a
References: [{'name': 'JVNDB-2014-000074', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000074'}, {'name': 'JVN#31082531', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN31082531/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cs.cybozu.co.jp/information/gr20140714up01.php'}]
CVE State: PUBLISHED
Explain CVE-2014-1997
The ATEN CN8000 remote-access unit with firmware 1.6.154 and earlier allows remote attackers to cause a denial of service via unspecified vectors.
Affected Products: n/a
References: [{'name': '67816', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67816'}, {'name': 'JVNDB-2014-000046', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000046'}, {'name': 'JVN#78136804', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN78136804/index.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1998
Cross-site scripting (XSS) vulnerability in Nippon Institute of Agroinformatics SOY CMS 1.4.0c and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#54650130', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN54650130/index.html'}, {'name': 'JVNDB-2014-000047', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000047'}]
CVE State: PUBLISHED
Explain CVE-2014-1999
The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://fuelphp.com/security-advisories'}, {'name': 'JVNDB-2014-000082', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2014-000082'}, {'name': 'JVN#94791545', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN94791545/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0001
The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-006', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-006'}, {'name': 'win-ms15kb3004365-update(99514)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99514'}, {'name': 'ms-wer-cve20150001-security-bypass(99513)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99513'}, {'name': '62134', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62134'}, {'name': '71927', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71927'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0002
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
Affected Products: n/a
References: [{'name': 'ms-appcompatcache-cve20150002-priv-esc(99523)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99523'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=118'}, {'name': '71972', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71972'}, {'name': 'win-ms15kb3023266-update(99524)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99524'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zdnet.com/article/google-discloses-unpatched-windows-vulnerability/'}, {'name': 'MS15-001', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-001'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/sambowne/statuses/550384131683520512'}, {'name': '61277', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61277'}]
CVE State: PUBLISHED
Explain CVE-2015-0003
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-010', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010'}, {'name': 'ms-kmd-cve20150003-priv-esc(100430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100430'}, {'name': '72457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72457'}]
CVE State: PUBLISHED
Explain CVE-2015-0004
The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."
Affected Products: n/a
References: [{'name': '71967', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71967'}, {'name': '61927', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61927'}, {'name': 'ms-profsvc-cve20150004-priv-esc(99519)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99519'}, {'name': 'MS15-003', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-003'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/google-security-research/issues/detail?id=123'}, {'name': 'win-ms15kb3021674-update(99520)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99520'}]
CVE State: PUBLISHED
Explain CVE-2015-0005
The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.samba.org/samba/history/samba-4.2.10.html'}, {'name': '1031891', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031891'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130773/Windows-Pass-Through-Authentication-Methods-Improper-Validation.html'}, {'name': '20150310 [CORE-2015-0005] - Windows Pass-Through Authentication Methods Improper Validation', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Mar/60'}, {'name': 'MS15-027', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-027'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/windows-pass-through-authentication-methods-improper-validation'}]
CVE State: PUBLISHED
Explain CVE-2015-0006
The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Affected Products: n/a
References: [{'name': '62184', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62184'}, {'name': 'MS15-005', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-005'}, {'name': '71930', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71930'}, {'name': 'win-ms15kb3022777-update(99522)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99522'}, {'name': '62098', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62098'}, {'name': 'ms-nla-cve20150006-security-bypass(99521)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99521'}]
CVE State: PUBLISHED
Explain CVE-2015-0008
The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-011', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-011'}, {'name': 'VU#787252', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/787252'}, {'name': 'ms-grouppolicy-cve20150008-code-exec(100426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx'}, {'name': '1031719', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031719'}, {'name': '72477', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72477'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.jasadvisors.com/additonal-jasbug-security-exploit-info/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155002/Microsoft-Windows-Server-2012-Group-Policy-Remote-Code-Execution.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0009
The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-014', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-014'}, {'name': '72476', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72476'}, {'name': '1031722', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031722'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155007/Microsoft-Windows-Server-2012-Group-Policy-Security-Feature-Bypass.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0010
The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
Affected Products: n/a
References: [{'name': 'MS15-010', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010'}, {'name': '72461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72461'}, {'tags': ['x_refsource_MISC'], 'url': 'http://code.google.com/p/google-security-research/issues/detail?id=128'}]
CVE State: PUBLISHED
Explain CVE-2015-0011
mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
Affected Products: n/a
References: [{'name': 'ms-webdav-cve20150011-priv-esc(99527)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99527'}, {'name': 'MS15-008', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-008'}, {'name': '1031531', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031531'}, {'name': '71960', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71960'}, {'name': '62154', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62154'}, {'name': 'win-ms15kb3019215-update(99526)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99526'}]
CVE State: PUBLISHED
Explain CVE-2015-0012
Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."
Affected Products: n/a
References: [{'name': 'ms-vmmanager-cve20150012-priv-esc(100428)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100428'}, {'name': '1031726', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031726'}, {'name': 'MS15-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-017'}, {'name': '72473', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72473'}, {'name': '1034652', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034652'}]
CVE State: PUBLISHED
Explain CVE-2015-0014
Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-002', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-002'}, {'name': 'ms-telnet-cve20150014-code-exec(99517)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99517'}, {'name': '71968', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71968'}, {'name': '61580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61580'}, {'name': 'win-ms15kb3020393-update(99518)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99518'}, {'name': '1031523', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031523'}]
CVE State: PUBLISHED
Explain CVE-2015-0015
Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."
Affected Products: n/a
References: [{'name': 'MS15-007', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007'}, {'name': '1031532', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031532'}, {'name': '71933', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71933'}, {'name': '62148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62148'}]
CVE State: PUBLISHED