Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-0847
nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a denial of service (deadlock) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'DSA-3271', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3271'}, {'name': '[Nbd] 20150507 [PATCH] nbd-server: fix unsafe signal handling', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/p/nbd/mailman/message/34091218/'}, {'name': 'USN-2676-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2676-1'}, {'name': 'openSUSE-SU-2015:0994', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/nbd/files/nbd/3.11/'}, {'name': '[oss-security] 20150507 CVE-2015-0847 in nbd-server', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/05/07/9'}]
CVE State: PUBLISHED
Explain CVE-2015-0848
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
Affected Products: n/a
References: [{'name': 'DSA-3302', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3302'}, {'name': '[oss-security] 20150601 CVE-2015-0848 - Heap overflow on libwmf0.2-7', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/06/01/2'}, {'name': 'FEDORA-2015-14847', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165547.html'}, {'name': 'FEDORA-2015-14848', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168507.html'}, {'name': 'openSUSE-SU-2015:1132', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00051.html'}, {'name': 'GLSA-201602-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201602-03'}, {'name': 'FEDORA-2015-9674', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160668.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': 'USN-2670-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2670-1'}, {'name': 'openSUSE-SU-2015:1134', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00053.html'}, {'name': '74923', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74923'}, {'name': '1032771', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032771'}, {'name': 'openSUSE-SU-2015:1212', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00018.html'}, {'name': 'RHSA-2015:1917', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1917.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0850
The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://fusionforge.org/forum/forum.php?forum_id=41'}, {'name': 'DSA-3275', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3275'}]
CVE State: PUBLISHED
Explain CVE-2015-0851
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://shibboleth.net/community/advisories/secadv_20150721.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.shibboleth.net/view/?p=cpp-xmltooling.git%3Ba=commitdiff%3Bh=2d795c731e6729309044607154978696a87fd900'}, {'name': '76134', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76134'}, {'name': 'DSA-3321', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3321'}]
CVE State: PUBLISHED
Explain CVE-2015-0852
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
Affected Products: n/a
References: [{'name': '1034077', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034077'}, {'name': 'FEDORA-2015-16105', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'name': 'FEDORA-2015-decbab7c9f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172491.html'}, {'name': 'DSA-3392', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3392'}, {'name': 'FEDORA-2015-992342e82f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172583.html'}, {'name': 'FEDORA-2015-16104', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168023.html'}, {'name': '[oss-security] 20150828 CVE-2015-0852 [FreeImage] Integer overflow in PluginPCX.cpp', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/08/28/1'}, {'name': 'FEDORA-2015-16106', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167766.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797165'}, {'name': 'GLSA-201701-68', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-68'}]
CVE State: PUBLISHED
Explain CVE-2015-0853
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$(xeyes).
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pysvn.tigris.org/issues/show_bug.cgi?id=202'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/svn-workbench/+bug/1495268'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1262928'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798863'}, {'name': '[oss-security] 20150913 CVE-2015-0853: insecure use of os.system() in svn-workbench', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/13/3'}]
CVE State: PUBLISHED
Explain CVE-2015-0854
App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/shutter/+bug/1495163'}]
CVE State: PUBLISHED
Explain CVE-2015-0855
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Affected Products: n/a
References: [{'name': '97283', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97283'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2'}, {'name': '[oss-security] 20151223 pitivi: CVE-2015-0855: Insecure use of os.system()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/12/23/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/pitivi/+bug/1495272'}]
CVE State: PUBLISHED
Explain CVE-2015-0856
daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme.
Affected Products: n/a
References: [{'name': '77099', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/77099'}, {'name': 'FEDORA-2015-9f996ea146', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171443.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/sddm/sddm/wiki/0.13.0-Release-Announcement'}, {'name': '[oss-security] 20151014 CVE-2015-0856: sddm does not prevent access to the KDE crash handler', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/10/14/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/sddm/sddm/commit/4cfed6b0a625593fb43876f04badc4dd99799d86'}]
CVE State: PUBLISHED
Explain CVE-2015-0857
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=a18e8df51511df276e61dbccdbe1714fc53af965'}, {'name': 'DSA-3562', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3562'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a'}]
CVE State: PUBLISHED
Explain CVE-2015-0858
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Affected Products: n/a
References: [{'name': 'DSA-3562', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3562'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a'}]
CVE State: PUBLISHED
Explain CVE-2015-0859
The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.
Affected Products: n/a
References: [{'name': 'DSA-3405', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3405'}]
CVE State: PUBLISHED
Explain CVE-2015-0860
Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798324'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/extract.c?id=e65aa3db04eb908c9507d5d356a95cedb890814d'}, {'name': 'GLSA-201612-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-07'}, {'name': 'DSA-3407', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3407'}, {'tags': ['x_refsource_MISC'], 'url': 'https://blog.fuzzing-project.org/30-Stack-overflows-and-out-of-bounds-read-in-dpkg-Debian.html'}, {'name': 'USN-2820-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2820-1'}]
CVE State: PUBLISHED
Explain CVE-2015-0861
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tryton.org/posts/security-release-for-issue5167.html'}, {'name': 'DSA-3425', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3425'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.tryton.org/issue5167'}]
CVE State: PUBLISHED
Explain CVE-2015-0862
Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100'}]
CVE State: PUBLISHED
Explain CVE-2015-0863
GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.nowsecure.com/blog/2015/01/26/samsung-account-and-galaxy-apps-technical-breakdown-cve-2015-0863-and-cve-2015-0864/'}]
CVE State: PUBLISHED
Explain CVE-2015-0864
Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
Affected Products: n/a
References: [{'name': '97207', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97207'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.nowsecure.com/blog/2015/01/26/samsung-account-and-galaxy-apps-technical-breakdown-cve-2015-0863-and-cve-2015-0864/'}]
CVE State: PUBLISHED
Explain CVE-2015-0866
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23247'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://forums.manageengine.com/topic/security-update-for-supportcenter-plus'}, {'name': '72349', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72349'}, {'name': '20150128 Two XSS Vulnerabilities in SupportCenter Plus', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534564/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2015-0867
Directory traversal vulnerability in SYNCK GRAPHICA Download Log CGI 3.0 and earlier allows remote attackers to read arbitrary files via a crafted filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.synck.com/blogs/news/weblog_1420694040.html'}, {'name': 'JVNDB-2015-000006', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000006'}, {'name': 'JVN#88559134', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN88559134/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0868
Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000008', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000008'}, {'name': 'JVN#94502417', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN94502417/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.t-okada.com/cgi-bin/sb2_data/sb2_data_news.cgi?action=data_list&cat=16#495'}]
CVE State: PUBLISHED
Explain CVE-2015-0869
I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Affected Products: n/a
References: [{'name': 'JVN#27142693', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN27142693/index.html'}, {'name': 'JVNDB-2015-000009', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000009'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2015/np-bbrm/'}]
CVE State: PUBLISHED
Explain CVE-2015-0870
Cross-site scripting (XSS) vulnerability in hb.cgi in Nishishi Factory Fumy News Clipper 2.x before 2.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nishishi.com/cgi/newsclip/20150130.html'}, {'name': 'JVNDB-2015-000010', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000010'}, {'name': 'JVN#33735535', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33735535/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN33735535/995592/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0871
Cross-site scripting (XSS) vulnerability in Mrs. Shiromuku Perl CGI shiromuku(u1)GUESTBOOK 1.62 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN17480391/995116/index.html'}, {'name': 'JVN#17480391', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN17480391/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0873
Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#96155055', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN96155055/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0874
Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.
Affected Products: n/a
References: [{'name': '72597', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72597'}, {'name': 'JVNDB-2015-000015', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000015.html'}, {'name': 'JVN#14522790', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14522790/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0875
The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000016', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000016'}, {'name': 'JVN#48659722', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN48659722/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.okb.co.jp/okdirect/sp_passbook/information01.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0876
Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000017', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000017'}, {'name': 'JVN#18387086', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18387086/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/sauruscms/Saurus-CMS-Community-Edition/commit/1bc272874a86eaab99dccd00b29177423fd83877'}]
CVE State: PUBLISHED
Explain CVE-2015-0877
Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \0 character in its name.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000018', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.jp/projects/cb-moyuku/news/'}, {'name': 'JVN#73261710', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73261710/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0878
Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
Affected Products: n/a
References: [{'name': 'JVN#77294617', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77294617/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.almail.com/vulnerability.html'}, {'name': 'JVNDB-2015-000020', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000020'}]
CVE State: PUBLISHED
Explain CVE-2015-0879
CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment.
Affected Products: n/a
References: [{'name': 'JVN#55365709', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55365709/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.almail.com/vulnerability.html'}, {'name': 'JVNDB-2015-000021', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000021'}]
CVE State: PUBLISHED
Explain CVE-2015-0880
Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.almail.com/vulnerability.html'}, {'name': 'JVNDB-2015-000022', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000022'}, {'name': 'JVN#93318392', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93318392/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0881
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000019', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000019'}, {'name': 'JVN#64455813', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN64455813/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0882
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Affected Products: n/a
References: [{'name': 'JVN#44544694', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN44544694/index.html'}, {'name': 'JVNDB-2015-000027', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN44544694/281242/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/zencart-ja/zc-v1-series/commit/022949bd09444d7e58703cc537dbbd5744c381b8'}]
CVE State: PUBLISHED
Explain CVE-2015-0883
SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#30135729', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN30135729/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.synck.com/blogs/news/weblog_1424791052.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN30135729/995637/index.html'}, {'name': 'JVNDB-2015-000026', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000026'}]
CVE State: PUBLISHED
Explain CVE-2015-0884
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.support.toshiba.com/sscontent?contentId=4007187'}, {'name': '1031825', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.support.toshiba.com/sscontent?contentId=4007185'}, {'name': 'VU#632140', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/632140'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/vu/JVNVU99205169/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0885
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.
Affected Products: n/a
References: [{'name': 'JVN#34790526', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN34790526/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN34790526/995575/index.html'}, {'name': 'DSA-3192', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3192'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://checkpw.sourceforge.net/checkpw/changes.txt'}, {'name': 'JVNDB-2015-000032', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000032'}]
CVE State: PUBLISHED
Explain CVE-2015-0886
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-3032', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151786.html'}, {'name': 'FEDORA-2015-3120', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html'}, {'name': 'JVN#77718330', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77718330/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mindrot.org/projects/jBCrypt/news/rel04.html'}, {'name': 'FEDORA-2015-2994', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151797.html'}, {'name': 'JVNDB-2015-000033', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000033'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mindrot.org/show_bug.cgi?id=2097'}, {'name': '[cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rd5c2256b8dc9935e4bb5e9be90adce58408054bb42523730a40c5548%40%3Ccommits.cassandra.apache.org%3E'}, {'name': '[cassandra-commits] 20210924 [jira] [Created] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/re330cfe9e5d84e3f7da8ace23ec32f38cb3fbd328bf177badd7ad942%40%3Ccommits.cassandra.apache.org%3E'}, {'name': '[cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rbd23e3ac8113b4da0a025c0e45170b6ec317383a1cf06090c2c717aa%40%3Ccommits.cassandra.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2015-0887
npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.seil.jp/support/security/a01541.html'}, {'name': 'JVNDB-2015-000031', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000031'}, {'name': 'JVN#63949115', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63949115/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0888
KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000028', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000028'}, {'name': 'JVN#62298871', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN62298871/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kent-web.com/bbs/clipbbs.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0889
KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000024', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kent-web.com/bbs/joyful.html'}, {'name': 'JVN#88862608', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN88862608/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0890
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000030', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000030'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/google-captcha/changelog/'}, {'name': 'JVN#55063777', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55063777/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0891
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000034', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000034'}, {'name': 'JVN#63687798', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63687798/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/en/jp/JVN63687798/995638/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0892
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#09871547', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN09871547/index.html'}, {'name': 'JVNDB-2015-000035', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000035'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/en/jp/JVN09871547/995638/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0893
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#91016415', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91016415/index.html'}, {'name': 'JVNDB-2015-000036', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000036'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/en/jp/JVN91016415/995638/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0894
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/'}, {'name': 'JVN#30832515', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN30832515/index.html'}, {'name': 'JVNDB-2015-000037', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000037'}]
CVE State: PUBLISHED
Explain CVE-2015-0895
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/'}, {'name': 'JVN#87204433', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN87204433/index.html'}, {'name': 'JVNDB-2015-000038', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000038'}]
CVE State: PUBLISHED
Explain CVE-2015-0896
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000039', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000039'}, {'name': 'JVN#97099798', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN97099798/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://extplorer.net/news/16'}]
CVE State: PUBLISHED
Explain CVE-2015-0898
futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#39175666', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN39175666/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.futomi.com/library/info/2015/20150319.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN39175666/221504/index.html'}, {'name': 'JVNDB-2015-000041', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000041'}]
CVE State: PUBLISHED
Explain CVE-2015-0899
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180629-0006/'}, {'name': 'JVNDB-2015-000042', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042'}, {'name': 'JVN#86448949', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN86448949/index.html'}, {'name': 'DSA-3536', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3536'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN'}, {'name': '74423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74423'}]
CVE State: PUBLISHED
Explain CVE-2015-0900
Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN74547976/995592/index.html'}, {'name': 'JVNDB-2015-000043', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000043'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nishishi.com/cgi/ftsb/20150321.html'}, {'name': 'JVN#74547976', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN74547976/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0901
Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/7872'}, {'name': 'JVNDB-2015-000044', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000044'}, {'name': 'JVN#97281747', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN97281747/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0902
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Affected Products: n/a
References: [{'name': 'JVN#75615300', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN75615300/index.html'}, {'name': 'JVNDB-2015-000046', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000046'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/'}]
CVE State: PUBLISHED
Explain CVE-2015-0903
Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN58784309/294291/index.html'}, {'name': 'JVNDB-2015-000048', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000048'}, {'name': 'JVN#58784309', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN58784309/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0904
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000049', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000049.html'}, {'name': 'JVN#68819526', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN68819526/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0905
Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/projects/bblog/'}, {'name': '1032041', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032041'}, {'name': 'JVN#71903938', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN71903938/index.html'}, {'name': 'JVNDB-2015-000047', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000047'}]
CVE State: PUBLISHED
Explain CVE-2015-0906
Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive.
Affected Products: n/a
References: [{'name': 'JVN#02527990', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN02527990/index.html'}, {'name': 'JVNDB-2015-000050', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000050'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www7a.biglobe.ne.jp/~schezo/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN02527990/414318/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0907
Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive.
Affected Products: n/a
References: [{'name': 'JVN#12329472', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN12329472/index.html'}, {'name': 'JVNDB-2015-000051', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www7a.biglobe.ne.jp/~schezo/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN12329472/414318/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0910
Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000054', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/'}, {'name': 'JVN#26860747', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26860747/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0911
Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000055', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000055'}, {'name': 'JVN#41653647', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN41653647/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/'}]
CVE State: PUBLISHED
Explain CVE-2015-0912
EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#67520407', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67520407/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN67520407/995657/index.html'}, {'name': 'JVNDB-2015-000060', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000060'}]
CVE State: PUBLISHED
Explain CVE-2015-0913
Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#07538357', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN07538357/index.html'}, {'name': 'JVNDB-2015-000061', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000061'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN07538357/995657/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0914
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000062', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000062'}, {'name': 'JVN#96439865', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN96439865/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jvn.jp/en/jp/JVN96439865/995657/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0915
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.
Affected Products: n/a
References: [{'name': 'JVNDB-2015-000063', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000063'}, {'name': 'JVN#20133698', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN20133698/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.maildealer.jp/announce/150511.php'}]
CVE State: PUBLISHED
Explain CVE-2015-0916
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cacti.net/release_notes_0_8_6f.php'}, {'name': 'JVNDB-2015-000064', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064'}, {'name': 'JVN#18957556', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18957556/index.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0917
Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129826/Kajona-CMS-4.6-Cross-Site-Scripting.html'}, {'name': '20150106 Reflecting XSS vulnerability in CMS Kajona v. 4.6', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-01.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7'}]
CVE State: PUBLISHED