Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-0918
Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
Affected Products: n/a
References: [{'name': '20150106 Reflecting XSS vulnerability in CMS Sefrengo v.1.6.0', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-06.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129825/Sefrengo-CMS-1.6.0-Cross-Site-Scripting.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.sefrengo.org/index.php?showtopic=3360'}]
CVE State: PUBLISHED
Explain CVE-2015-0919
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
Affected Products: n/a
References: [{'name': '20150106 SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.sefrengo.org/index.php?showtopic=3360'}]
CVE State: PUBLISHED
Explain CVE-2015-0920
Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Affected Products: n/a
References: [{'name': 'bannereffect-wp-bannereffectemail-xss(99613)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99613'}, {'name': 'bannereffect-wp-bannereffectemail-csrf(99614)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99614'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129804/WordPress-Banner-Effect-Header-1.2.6-XSS-CSRF.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0921
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Affected Products: n/a
References: [{'name': '61922', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61922'}, {'name': '20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/37'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10095'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html'}, {'name': '20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/8'}, {'name': '1031519', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031519'}, {'name': 'macafee-cve20150921-info-disc(99950)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99950'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/brandonprry/692e553975bf29aeaf2c'}]
CVE State: PUBLISHED
Explain CVE-2015-0922
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Affected Products: n/a
References: [{'name': '72298', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72298'}, {'name': '20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/37'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10095'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html'}, {'name': '20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/8'}, {'name': 'macafee-cve20150922-info-disc(99949)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99949'}, {'name': '1031519', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031519'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/brandonprry/692e553975bf29aeaf2c'}]
CVE State: PUBLISHED
Explain CVE-2015-0923
The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.
Affected Products: n/a
References: [{'name': 'VU#377644', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/377644'}]
CVE State: PUBLISHED
Explain CVE-2015-0924
Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a (1) HTTP, (2) SSH, (3) TELNET, or (4) CLI session.
Affected Products: n/a
References: [{'name': 'VU#936356', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/936356'}]
CVE State: PUBLISHED
Explain CVE-2015-0925
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Affected Products: n/a
References: [{'name': 'VU#110652', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/110652'}]
CVE State: PUBLISHED
Explain CVE-2015-0926
Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file.
Affected Products: n/a
References: [{'name': 'VU#637068', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/637068'}]
CVE State: PUBLISHED
Explain CVE-2015-0928
libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://redmine.openinfosecfoundation.org/issues/1272'}, {'name': '73117', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73117'}]
CVE State: PUBLISHED
Explain CVE-2015-0929
time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
Affected Products: n/a
References: [{'name': 'VU#522460', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/522460'}]
CVE State: PUBLISHED
Explain CVE-2015-0930
The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session.
Affected Products: n/a
References: [{'name': 'VU#522460', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/522460'}]
CVE State: PUBLISHED
Explain CVE-2015-0931
Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
Affected Products: n/a
References: [{'name': 'VU#377644', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/377644'}]
CVE State: PUBLISHED
Explain CVE-2015-0932
The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.wired.com/2015/03/big-vulnerability-hotel-wi-fi-router-puts-guests-risk/'}, {'name': 'VU#930956', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/930956'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.cylance.com/spear-team-cve-2015-0932'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.antlabs.com/index.php?option=com_content&view=article&id=195:rsync-remote-file-system-access-vulnerability-cve-2015-0932&catid=54:advisories&Itemid=133'}]
CVE State: PUBLISHED
Explain CVE-2015-0933
Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
Affected Products: n/a
References: [{'name': 'VU#302668', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/302668'}]
CVE State: PUBLISHED
Explain CVE-2015-0934
Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.
Affected Products: n/a
References: [{'name': 'VU#302668', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/302668'}]
CVE State: PUBLISHED
Explain CVE-2015-0935
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Affected Products: n/a
References: [{'name': 'VU#978652', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/978652'}, {'name': '74460', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74460'}, {'name': '39958', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39958/'}]
CVE State: PUBLISHED
Explain CVE-2015-0936
Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131259/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjs47SGp47UAhVF5iYKHYGLDQkQFggoMAE&url=https%3A%2F%2Fwww.rapid7.com%2Fdb%2Fmodules%2Fexploit%2Flinux%2Fssh%2Fceragon_fibeair_known_privkey&usg=AFQjCNFZiZcWj47cpqPX-AbfpsW0DL4yYw'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/131260/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html'}, {'name': '73696', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73696'}, {'name': '20150401 Ceragon FibeAir IP-10 SSH Private Key Exposure (CVE-2015-0936)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Apr/3'}]
CVE State: PUBLISHED
Explain CVE-2015-0937
Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bto.bluecoat.com/security-advisory/sa94'}, {'name': 'VU#274244', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/274244'}]
CVE State: PUBLISHED
Explain CVE-2015-0938
search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bto.bluecoat.com/security-advisory/sa94'}, {'name': 'VU#274244', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/274244'}]
CVE State: PUBLISHED
Explain CVE-2015-0941
The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Affected Products: n/a
References: [{'name': 'VU#894897', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/894897'}]
CVE State: PUBLISHED
Explain CVE-2015-0943
Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream.
Affected Products: n/a
References: [{'name': '20150727 Multiple unresolved vulnerabilities in Basware Banking/Maksuliikenne', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jul/120'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0949
The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Affected Products: Latitude E6430
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.kb.cert.org/vuls/id/631788'}]
CVE State: PUBLISHED
Explain CVE-2015-0950
Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.x-cart.com/5-1-11-released.html'}, {'name': 'VU#924124', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/924124'}]
CVE State: PUBLISHED
Explain CVE-2015-0951
X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.x-cart.com/5-1-11-released.html'}, {'name': 'VU#924124', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/924124'}]
CVE State: PUBLISHED
Explain CVE-2015-0961
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': 'VU#534407', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/534407'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://techlib.barracuda.com/BWF/UpdateSSLCerts'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.barracuda.com/support/techalerts'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/'}]
CVE State: PUBLISHED
Explain CVE-2015-0962
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Affected Products: n/a
References: [{'name': 'VU#534407', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/534407'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://techlib.barracuda.com/BWF/UpdateSSLCerts'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.barracuda.com/support/techalerts'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/'}]
CVE State: PUBLISHED
Explain CVE-2015-0967
Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Affected Products: n/a
References: [{'name': 'VU#697316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/697316'}]
CVE State: PUBLISHED
Explain CVE-2015-0968
Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590.
Affected Products: n/a
References: [{'name': 'VU#697316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/697316'}]
CVE State: PUBLISHED
Explain CVE-2015-0969
SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.
Affected Products: n/a
References: [{'name': 'VU#697316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/697316'}]
CVE State: PUBLISHED
Explain CVE-2015-0970
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': 'VU#697316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/697316'}]
CVE State: PUBLISHED
Explain CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/'}, {'name': 'DSA-3254', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3254'}]
CVE State: PUBLISHED
Explain CVE-2015-0972
Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.
Affected Products: n/a
References: [{'name': 'VU#626420', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/626420'}]
CVE State: PUBLISHED
Explain CVE-2015-0973
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2016-03-21-5', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT206167'}, {'name': '[png-mng-announce] 20141222 libpng-1.5.21 and 1.6.16 are available', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/p/png-mng/mailman/message/33173461/'}, {'name': '[oss-security] 20150109 Re: CVE Request: libpng 1.6.15 Heap Overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/10/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html'}, {'name': '[oss-security] 20150110 Re: CVE Request: libpng 1.6.15 Heap Overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/10/3'}, {'name': '62725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62725'}, {'tags': ['x_refsource_MISC'], 'url': 'http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-0974
Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/129808/ZTE-Datacard-MF19-Privilege-Escalation-DLL-Hijacking.html'}]
CVE State: PUBLISHED
Explain CVE-2015-0976
Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0977
Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0978
Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.  NOTE: this may overlap CVE-2015-2264.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A'}]
CVE State: PUBLISHED
Explain CVE-2015-0979
Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03'}]
CVE State: PUBLISHED
Explain CVE-2015-0980
Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03'}]
CVE State: PUBLISHED
Explain CVE-2015-0981
The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03'}]
CVE State: PUBLISHED
Explain CVE-2015-0982
Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_File_Id=755516404&p_File_Name=SEVD-2015-065-01+Pelco+DS-NVs+Video+Mgmt+SW.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0984
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02'}, {'name': '20150422 CVE-2015-0984 SCADA - Gaining remote shell on Honeywell Falcon XLWEB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Apr/79'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.outpost24.com/hacking-industrial-control-systems-case-study-falcon/'}]
CVE State: PUBLISHED
Explain CVE-2015-0985
Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0986
Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-097-01'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-15-392'}, {'name': '73960', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73960'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.moxa.com/support/download.aspx?d_id=2114'}]
CVE State: PUBLISHED
Explain CVE-2015-0987
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0988
Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0989
PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02'}]
CVE State: PUBLISHED
Explain CVE-2015-0990
Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-02'}]
CVE State: PUBLISHED
Explain CVE-2015-0991
Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0992
Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0993
Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0994
Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0995
Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01'}]
CVE State: PUBLISHED
Explain CVE-2015-0996
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02'}]
CVE State: PUBLISHED
Explain CVE-2015-0997
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02'}]
CVE State: PUBLISHED
Explain CVE-2015-0998
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02'}]
CVE State: PUBLISHED
Explain CVE-2015-0999
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02'}]
CVE State: PUBLISHED
Explain CVE-2015-1000
Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://zerodayinitiative.com/advisories/ZDI-15-120/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-153-02'}, {'name': '74966', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74966'}]
CVE State: PUBLISHED
Explain CVE-2015-1001
Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02'}]
CVE State: PUBLISHED
Explain CVE-2015-1002
IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02'}]
CVE State: PUBLISHED
Explain CVE-2015-1003
Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02'}]
CVE State: PUBLISHED
Explain CVE-2015-1005
IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1006
A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
Affected Products: PAC Project Professional
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1007
A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Affected Products: PAC Project Professional
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1008
SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01'}, {'name': '74774', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74774'}]
CVE State: PUBLISHED
Explain CVE-2015-1009
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gcsresource.invensys.com/support/docs/_securitybulletins/Security_bulletin_LFSEC00000110.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-100-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1010
Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://rockwellautomation.custhelp.com/app/answers/detail/a_id/700915'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02'}]
CVE State: PUBLISHED
Explain CVE-2015-1011
Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A'}]
CVE State: PUBLISHED
Explain CVE-2015-1012
Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.
Affected Products: LifeCare PCA Infusion System
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1013
OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1014
A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.
Affected Products: OFS v3.5
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1015
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01'}]
CVE State: PUBLISHED
Explain CVE-2015-1026
Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html'}, {'name': '20150310 Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Build 6270)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534833/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2015-1027
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/percona-toolkit/+bug/1408375'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/'}]
CVE State: PUBLISHED
Explain CVE-2015-1028
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).
Affected Products: n/a
References: [{'name': '35751', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35751'}, {'name': '35747', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35747'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.xlabs.com.br/blog/?p=339'}, {'name': '35750', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35750'}]
CVE State: PUBLISHED
Explain CVE-2015-1029
The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://puppetlabs.com/security/cve/cve-2015-1029'}, {'name': '62328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62328'}]
CVE State: PUBLISHED
Explain CVE-2015-1030
Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.
Affected Products: n/a
References: [{'name': '62123', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62123'}, {'name': '[oss-security] 20150110 Re: CVE Request for Privoxy Version: 3.0.22', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.privoxy.org/announce.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-1031
Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'DSA-3133', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3133'}, {'name': '62123', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62123'}, {'name': '[oss-security] 20150110 Re: CVE Request for Privoxy Version: 3.0.22', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/11/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.privoxy.org/announce.txt'}]
CVE State: PUBLISHED
Explain CVE-2015-1032
Cross-site scripting (XSS) vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/p/kiwix/bugs/763/'}, {'name': '20150118 CVE-2015-1032 Kiwix Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534502/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130007/Kiwix-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED