Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1386
Directory traversal vulnerability in unshield 1.0-1.
Affected Products: n/a
References: [{'name': '[oss-security] 20150127 Re: unshield directory traversal', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/27'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1185717'}]
CVE State: PUBLISHED
Explain CVE-2015-1388
The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-004.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-1389
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/132060/Aruba-ClearPass-Policy-Manager-6.4-Cross-Site-Scripting.html'}, {'name': '37172', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/37172/'}, {'name': '20150527 ClearPass Policy Manager Stored XSS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/May/115'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1392
Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-1393
SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
Affected Products: n/a
References: [{'name': '20150128 [CVE-2015-1393] Photo Gallery (Wordpress Plugin) - SQL Injection in Version 1.2.8', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534569/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/1074134/photo-gallery'}]
CVE State: PUBLISHED
Explain CVE-2015-1394
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/photo-gallery/changelog/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/archive/1/archive/1/534568/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/1073334/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/1076678/photo-gallery'}, {'tags': ['x_refsource_MISC'], 'url': 'https://seclists.org/bugtraq/2015/Jan/140'}]
CVE State: PUBLISHED
Explain CVE-2015-1395
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775873'}, {'name': '72846', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72846'}, {'name': 'FEDORA-2015-1134', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148953.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://savannah.gnu.org/bugs/?44059'}, {'name': '[oss-security] 20150127 Re: CVE Request: patch: directory traversal via file rename', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/28'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.savannah.gnu.org/cgit/patch.git/commit/?id=17953b5893f7c9835f0dd2a704ba04e0371d2cbd'}, {'name': 'FEDORA-2015-1165', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154214.html'}, {'name': 'USN-2651-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2651-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1184490'}]
CVE State: PUBLISHED
Explain CVE-2015-1396
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
Affected Products: n/a
References: [{'name': '[oss-security] 20150127 Re: CVE Request: patch: CVE needed for incomplete fix for CVE-2015-1196?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/29'}, {'name': '75358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75358'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1186764'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/75358'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ubuntu.com/usn/USN-2651-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/29'}]
CVE State: PUBLISHED
Explain CVE-2015-1397
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability'}, {'name': '1032194', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032194'}, {'tags': ['x_refsource_MISC'], 'url': 'https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/'}]
CVE State: PUBLISHED
Explain CVE-2015-1398
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability'}, {'name': '1032194', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032194'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/'}]
CVE State: PUBLISHED
Explain CVE-2015-1399
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability'}, {'name': '1032194', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032194'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/'}]
CVE State: PUBLISHED
Explain CVE-2015-1400
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.npds.org/viewtopic.php?topic=26189&forum=12'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.npds.org/viewtopic.php?topic=26233&forum=12'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecgeeks.com/npds-cms-sql-injection/'}]
CVE State: PUBLISHED
Explain CVE-2015-1401
Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
Affected Products: n/a
References: [{'name': '71981', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71981'}, {'name': '[oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/31'}, {'name': '[oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/7'}]
CVE State: PUBLISHED
Explain CVE-2015-1402
Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '71984', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71984'}, {'name': '[oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/'}, {'name': '[oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/31'}]
CVE State: PUBLISHED
Explain CVE-2015-1403
SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '71984', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71984'}, {'name': '[oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/'}, {'name': '[oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/31'}]
CVE State: PUBLISHED
Explain CVE-2015-1404
Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '71985', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71985'}, {'name': '[oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/'}, {'name': '[oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/31'}]
CVE State: PUBLISHED
Explain CVE-2015-1405
SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '71985', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71985'}, {'name': '[oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/7'}, {'tags': ['x_refsource_MISC'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/'}, {'name': '[oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002,  TYPO3-EXT-SA-2015-003', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/27/31'}]
CVE State: PUBLISHED
Explain CVE-2015-1414
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Affected Products: n/a
References: [{'name': 'DSA-3175', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3175'}, {'name': '72777', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72777'}, {'name': 'FreeBSD-SA-15:04', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10107'}, {'name': '1031798', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031798'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc'}]
CVE State: PUBLISHED
Explain CVE-2015-1415
The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
Affected Products: n/a
References: [{'name': '1032042', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032042'}, {'name': 'FreeBSD-SA-15:08', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.asc'}, {'name': '20150407 FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/535209/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131338/FreeBSD-10.x-ZFS-encryption.key-Disclosure.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1416
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
Affected Products: n/a
References: [{'name': '[oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/08/02/1'}, {'name': '[oss-security] 20150730 CVE-2015-1416: vulnerability in patch(1)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/07/30/9'}, {'name': '[oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/08/01/4'}, {'name': 'FreeBSD-SA-15:14', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-15:14.bsdpatch.asc'}, {'name': '1033110', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033110'}, {'name': '76116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76116'}, {'name': '[oss-security] 20150802 Re: CVE-2015-1416: vulnerability in patch(1)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/08/02/6'}]
CVE State: PUBLISHED
Explain CVE-2015-1417
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.
Affected Products: n/a
References: [{'name': '1033111', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033111'}, {'name': '76112', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76112'}, {'name': 'FreeBSD-SA-15:15', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-15:15.tcp.asc'}]
CVE State: PUBLISHED
Explain CVE-2015-1418
The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig'}, {'name': '76236', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76236'}, {'name': '1033188', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033188'}, {'name': 'FreeBSD-SA-15:18', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rachelbythebay.com/w/2018/04/05/bangpatch/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/894667'}]
CVE State: PUBLISHED
Explain CVE-2015-1419
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Affected Products: n/a
References: [{'name': 'SUSE-SU-2015:0136', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00023.html'}, {'name': 'openSUSE-SU-2015:0079', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00041.html'}, {'name': '62415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62415'}]
CVE State: PUBLISHED
Explain CVE-2015-1420
Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
Affected Products: n/a
References: [{'name': 'DSA-3170', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3170'}, {'name': 'USN-2660-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2660-1'}, {'name': '[oss-security] 20150129 CVE-2015-1420 - Linux kernel fs/fhandle.c race condition', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/29/12'}, {'name': 'USN-2665-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2665-1'}, {'name': '[linux-kernel] 20150128 [PATCH v2] vfs: read file_handle only once in handle_to_path', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-kernel&m=142247707318982&w=2'}, {'name': 'SUSE-SU-2015:1611', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html'}, {'name': 'USN-2661-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2661-1'}, {'name': 'openSUSE-SU-2015:1382', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1187534'}, {'name': 'SUSE-SU-2015:1478', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html'}, {'name': '72357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72357'}, {'name': 'USN-2667-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2667-1'}, {'name': 'SUSE-SU-2015:1224', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html'}, {'name': 'SUSE-SU-2015:1592', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1422
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html'}, {'name': '35767', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35767'}, {'name': '116970', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116970'}, {'name': 'geckocms-index-dialog-xss(99977)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99977'}, {'name': '116969', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116969'}, {'name': '116967', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116967'}]
CVE State: PUBLISHED
Explain CVE-2015-1423
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html'}, {'name': '35767', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35767'}, {'name': 'geckocms-index-sql-injection(99976)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99976'}, {'name': '116968', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116968'}]
CVE State: PUBLISHED
Explain CVE-2015-1424
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html'}, {'name': '35767', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35767'}, {'name': '116966', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/116966'}, {'name': 'geckocms-newuser-csrf(99974)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99974'}]
CVE State: PUBLISHED
Explain CVE-2015-1426
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://puppetlabs.com/security/cve/cve-2015-1426'}]
CVE State: PUBLISHED
Explain CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected Products: n/a
References: [{'name': '20150211 Elasticsearch vulnerability CVE-2015-1427', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534689/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html'}, {'name': 'RHSA-2017:0868', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2017:0868'}, {'name': '72585', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72585'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/'}, {'name': 'elasticsearch-cve20151427-command-exec(100850)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100850'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.elastic.co/community/security/'}]
CVE State: PUBLISHED
Explain CVE-2015-1428
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Affected Products: n/a
References: [{'name': '35972', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35972'}, {'name': '20150202 Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534593/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07'}]
CVE State: PUBLISHED
Explain CVE-2015-1429
Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cybelesoft.com/blog/index.php/cybele-software-inc-security-bulletin-2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.perspectiverisk.com/security-advisory-thinfinity-remote-desktop-workstation-directory-traversal/'}]
CVE State: PUBLISHED
Explain CVE-2015-1430
Buffer overflow in xymon 4.3.17-1.
Affected Products: n/a
References: [{'name': '[oss-security] 20150131 Re: CVE request: Xymon', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/31/4'}]
CVE State: PUBLISHED
Explain CVE-2015-1431
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpbb/phpbb/pull/3316'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tracker.phpbb.com/browse/PHPBB3-13531'}, {'name': '[oss-security] 20150131 Re: CVE request: phpbb3 CSRF and CSS injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/373'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.phpbb.com/Release_Highlights/3.0.13'}, {'name': 'GLSA-201701-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-25'}, {'name': '72405', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72405'}, {'name': 'phpbb3-cve20151431-xss(100670)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100670'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpbb/phpbb/commit/eaeb88133f1f028fa06f0ebe5639668436fd469e'}]
CVE State: PUBLISHED
Explain CVE-2015-1432
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Affected Products: n/a
References: [{'name': '[oss-security] 20150131 Re: CVE request: phpbb3 CSRF and CSS injection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/373'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.phpbb.com/Release_Highlights/3.0.13'}, {'name': 'GLSA-201701-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-25'}, {'name': 'phpbb3-cve20151432-csrf(100671)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100671'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/phpbb/phpbb/pull/3311'}, {'name': '72399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72399'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tracker.phpbb.com/browse/PHPBB3-13526'}]
CVE State: PUBLISHED
Explain CVE-2015-1433
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/changeset/786aa0725/github'}, {'name': '72401', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72401'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/ticket/1490227'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://roundcube.net/news/2015/01/24/security-update-1.0.5/'}, {'name': 'openSUSE-SU-2015:0286', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html'}, {'name': '[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/31/6'}, {'name': 'FEDORA-2015-1772', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html'}, {'name': '[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in  1.0.5', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/31/3'}]
CVE State: PUBLISHED
Explain CVE-2015-1434
Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Affected Products: n/a
References: [{'name': '20150211 Multiple Vulnerabilities in my little forum', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534681/100/0/threaded'}, {'name': '72575', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72575'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mylittleforum.net/forum/index.php?id=8182'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html'}, {'name': 'mylittleforum-cve20151434-sql-injection(100855)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100855'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23248'}]
CVE State: PUBLISHED
Explain CVE-2015-1435
Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
Affected Products: n/a
References: [{'name': '20150211 Multiple Vulnerabilities in my little forum', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534681/100/0/threaded'}, {'name': '72582', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72582'}, {'name': 'mylittleforum-cve20151435-xss(100856)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100856'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mylittleforum.net/forum/index.php?id=8182'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23248'}]
CVE State: PUBLISHED
Explain CVE-2015-1436
Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.
Affected Products: n/a
References: [{'name': 'wp-easingslider-cve20151436-xss(100861)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100861'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/easing-slider/changelog/'}, {'name': '20150211 Two Reflected XSS Vulnerabilities in Easing Slider WordPress Plugin', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534680/100/0/threaded'}, {'name': '72572', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72572'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.htbridge.com/advisory/HTB23249'}]
CVE State: PUBLISHED
Explain CVE-2015-1437
Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
Affected Products: n/a
References: [{'name': 'asus-rtn10-errorpage-xss(100563)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100563'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html'}, {'name': '20150203 CVE-2015-1437 XSS In ASUS Router.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534612/100/0/threaded'}, {'name': 'asus-rtn10-resultstatus-xss(100566)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100566'}, {'name': '72369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72369'}, {'name': '20150129 Unauthenticated Reflected XSS vulnarbility in Asus RT-N10 Plus router', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534580/100/0/threaded'}, {'name': '20150129 Reflected XSS vulnarbility in Asus RT-N10 Plus Router', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534579/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2015-1438
Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/132682/Panda-Security-1.0.0.13-Arbitrary-Code-Execution.html'}, {'name': '75715', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75715'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-1438/'}, {'name': '20151231 CVE-2015-1438 - Panda Security Multiple Products Arbitrary Code Execution', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jul/42'}, {'name': '20151231 CVE-2015-1438 - Arbitrary Code Execution [PSKMAD.sys] In Panda Security - Multiple Products', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jul/61'}]
CVE State: PUBLISHED
Explain CVE-2015-1441
SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwigo.org/releases/2.6.5'}, {'name': '62606', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62606'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwigo.org/releases/2.7.3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwigo.org/forum/viewtopic.php?id=25016'}, {'name': '72400', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72400'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://piwigo.org/releases/2.5.6'}]
CVE State: PUBLISHED
Explain CVE-2015-1442
SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action.  NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html'}, {'name': '[oss-security] 20150201 CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/379'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html'}, {'name': '[oss-security] 20150201 Re: CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/380'}, {'name': '20150201 SQL injection vulnerabilities in zerocms <= v.1.3.3', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Feb/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html'}, {'name': '72398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72398'}]
CVE State: PUBLISHED
Explain CVE-2015-1443
The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt'}, {'name': '[oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/02/01/5'}, {'name': '[oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/376'}]
CVE State: PUBLISHED
Explain CVE-2015-1444
Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the (1) conntrack.cgi, (2) index.cgi, (3) log_syslog.cgi, (4) problems.cgi, (5) status.cgi, (6) status_network.cgi, or (7) status_system.cgi script in admin/.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt'}, {'name': '[oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/376'}, {'name': 'fli4l-cve20151444-xss(100610)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100610'}, {'name': '[oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/381'}]
CVE State: PUBLISHED
Explain CVE-2015-1445
HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt'}, {'name': '[oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/02/01/5'}, {'name': '[oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q1/376'}]
CVE State: PUBLISHED
Explain CVE-2015-1448
The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1449
Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf'}]
CVE State: PUBLISHED
Explain CVE-2015-1450
SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130122/Restaurantbiller-SQL-Injection-Shell-Upload.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1451
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request.
Affected Products: n/a
References: [{'name': '20150129 Fortinet FortiOS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/125'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-15-002/'}, {'name': '61661', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61661'}, {'name': '72383', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72383'}]
CVE State: PUBLISHED
Explain CVE-2015-1452
The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.
Affected Products: n/a
References: [{'name': '20150129 Fortinet FortiOS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/125'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fortiguard.com/advisory/FG-IR-15-002/'}, {'name': '61661', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61661'}, {'name': '72383', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72383'}]
CVE State: PUBLISHED