Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-5024 State: PUBLISHED Published: 2015-10-05T10:00:00 Last Updated: 2024-08-06T06:32:32.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21967255
CVE ID: CVE-2015-5035 State: PUBLISHED Published: 2016-01-03T02:00:00 Last Updated: 2024-08-06T06:32:31.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21971439 - http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020
CVE ID: CVE-2015-5036 State: PUBLISHED Published: 2016-01-03T02:00:00 Last Updated: 2024-08-06T06:32:31.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5035. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21971439 - http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020
CVE ID: CVE-2015-5037 State: PUBLISHED Published: 2016-01-03T02:00:00 Last Updated: 2024-08-06T06:32:32.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21971439 - http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020
CVE ID: CVE-2015-5038 State: PUBLISHED Published: 2016-01-03T02:00:00 Last Updated: 2024-08-06T06:32:31.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recursion during XML entity expansion, which allows remote attackers to cause a denial of service (CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21971439 - http://www-01.ibm.com/support/docview
ntainer: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21971439 - http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020
CVE ID: CVE-2015-5039 State: PUBLISHED Published: 2018-03-26T18:00:00 Last Updated: 2024-08-06T06:32:32.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information or modify network traffic via a crafted certificate. IBM X-Force ID: 106715. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21976566 - https://exchange.xforce.ibmcloud.com
ontainer: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21976566 - https://exchange.xforce.ibmcloud.com/vulnerabilities/106715
CVE ID: CVE-2015-5040 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T06:32:32.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image, aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ, a different vulnerability than CVE-2015-4994. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033974 - http://www-01.ibm.com/support/docview.wss?uid=swg21969050
CVE ID: CVE-2015-5041 State: PUBLISHED Published: 2016-06-06T17:00:00 Last Updated: 2024-08-06T06:32:32.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00028.html - http://www-01.ibm.com/support/docview.wss?uid=swg1IV72872 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.html - https:/
pport/docview.wss?uid=swg1IV72872 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.html - https://access.redhat.com/errata/RHSA-2016:1430 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00026.html - http://www-01.ibm.com/support/docview.wss?uid=swg21974194 - http://www.securityfocus.com/bid/82451 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00032.html
CVE ID: CVE-2015-5042 State: PUBLISHED Published: 2016-02-15T02:00:00 Last Updated: 2024-08-06T06:32:32.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21973592
CVE ID: CVE-2015-5043 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T06:32:32.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21968616
CVE ID: CVE-2015-5044 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T06:32:32.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers to cause a denial of service via unspecified packets. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21969422
CVE ID: CVE-2015-5045 State: PUBLISHED Published: 2018-03-26T18:00:00 Last Updated: 2024-08-06T06:32:32.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via unspecified vectors. IBM X-Force ID: 106938. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21982895 - https://exchange.xforce.ibmcloud.com/vulnerabilities/106938
CVE ID: CVE-2015-5049 State: PUBLISHED Published: 2016-01-01T02:00:00 Last Updated: 2024-08-06T06:32:32.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21970590 - http://www.securityfocus.com/bid/79682
CVE ID: CVE-2015-5050 State: PUBLISHED Published: 2016-02-15T02:00:00 Last Updated: 2024-08-06T06:32:32.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21973592
CVE ID: CVE-2015-5051 State: PUBLISHED Published: 2016-01-03T02:00:00 Last Updated: 2024-08-06T06:32:32.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21970797
CVE ID: CVE-2015-5052 State: PUBLISHED Published: 2017-09-07T20:00:00 Last Updated: 2024-08-06T06:32:32.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Sefrengo before 1.6.5 beta2. Additional Analyst Notes: - CVE Program Container: References: - http://forum.sefrengo.org/index.php?showtopic=3399
CVE ID: CVE-2015-5053 State: PUBLISHED Published: 2015-11-24T20:00:00 Last Updated: 2024-08-06T06:32:32.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call. Additional Analyst Notes: - CVE Program Container: References: - http://nvidia.custhelp.com/a
_pfn kernel-mode API call. Additional Analyst Notes: - CVE Program Container: References: - http://nvidia.custhelp.com/app/answers/detail/a_id/3802
CVE ID: CVE-2015-5054 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T06:32:32.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html - http://www.securityfocus.com/archive/1/537029/100/0/threaded
CVE ID: CVE-2015-5057 State: PUBLISHED Published: 2017-08-18T18:00:00 Last Updated: 2024-08-06T06:32:32.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/broken-link-checker/#developers - http://www.openwall.com/lists/oss-security/2015/06/25/1 - http://www.securityfocus.com/bid/75421 - https://wpvulndb.com/vulnerabilities/8064
CVE ID: CVE-2015-5058 State: PUBLISHED Published: 2015-08-24T14:00:00 Last Updated: 2024-08-06T06:32:32.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/17000/000/sol17047.html - http:
- CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/17000/000/sol17047.html - http://www.securitytracker.com/id/1033334
CVE ID: CVE-2015-5059 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-06T06:32:32.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/06/25/3 - http://www.openwall.com/lists/oss-security/2015/06/25/4 - http://www.securityfocus.com/bid/7541
-security/2015/06/25/3 - http://www.openwall.com/lists/oss-security/2015/06/25/4 - http://www.securityfocus.com/bid/75414 - http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163191.html - https://github.com/mantisbt/mantisbt/commit/f39cf5251953b468e9d921e1cf2aca3abdb00772 - https://bugzilla.redhat.com/show_bug.cgi?id=1237199 - https://github.com/mantisbt/mantisbt/commit/a4be76d6e5c4939545d84712c79d3f8f4a108c4f
CVE ID: CVE-2015-5060 State: PUBLISHED Published: 2017-09-07T20:00:00 Last Updated: 2024-08-06T06:32:32.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. Additional Analyst Notes: - CVE Program Container: References: - http://github.com/anchorcms/anchor-cms/issues/875
CVE ID: CVE-2015-5061 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/132402/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/75411 - http://www.vulnerability-lab.com/get_content.php?i
-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/75411 - http://www.vulnerability-lab.com/get_content.php?id=1488
CVE ID: CVE-2015-5062 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132223/SilverStripe-CMS-3.1.13-XSS-Open-Redirect.html - http://hyp3rlinx.altervista.org/advisories/AS-SILVERSTRIPE0607.txt - http://www.securityfocus.com/archive/1/535716/100/0/threaded - http://www.securityfocus.com/b
/AS-SILVERSTRIPE0607.txt - http://www.securityfocus.com/archive/1/535716/100/0/threaded - http://www.securityfocus.com/bid/75419
CVE ID: CVE-2015-5063 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter to install.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132223/SilverStripe-CMS-3.1.13-XSS-Open-Redirect.html - http://hyp3rlinx.altervista.org/advisories/AS-SILVERSTRIPE0607.txt - http://www.securityfocus.com/archive/1/535716/100/0/threaded
CVE ID: CVE-2015-5064 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow remote attackers to inject arbitrary web script or HTML via the table_name parameter to (1) tabella.php, (2) coloni.php, or (3) insert.php or (4) num_row parameter to coloni.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75397 - http://packetstormsecurity.com/files/132420/MySQL-Lite-Administrator-Beta-1-Cross-Site-Scripting.html - http://www.securityfocu
packetstormsecurity.com/files/132420/MySQL-Lite-Administrator-Beta-1-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/535809/100/0/threaded - http://hyp3rlinx.altervista.org/advisories/AS-MYSQLLITEADMINISTRATOR0621.txt
CVE ID: CVE-2015-5065 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce - https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/ - http://packe
or-woocommerce - https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/ - http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html - https://www.exploit-db.com/exploits/37253/ - http://www.securityfocus.com/bid/75416
CVE ID: CVE-2015-5066 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535806/100/0/threaded - http://hyp3rlinx.altervista.org/advisories/AS-GENIXCMS0621.txt - http://packetstormsecurity.com/files/132397/GeniXC
ed - http://hyp3rlinx.altervista.org/advisories/AS-GENIXCMS0621.txt - http://packetstormsecurity.com/files/132397/GeniXCMS-0.0.3-Cross-Site-Scripting.html - https://github.com/semplon/GeniXCMS/releases/tag/v0.0.4 - https://www.exploit-db.com/exploits/37360/ - http://www.securityfocus.com/bid/75398
CVE ID: CVE-2015-5067 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials/ - https://erpscan.io/advisories/erpscan-15-016-sap-netweaver-hardcoded-credentials/ - http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2
6-sap-netweaver-hardcoded-credentials/ - http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015 - http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.html - http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.html - http://www.securityfocus.com/bid/75165
CVE ID: CVE-2015-5068 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T06:32:32.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133514/SAP-Mobile-Platform-3-XXE-Injection.html - http://www.securityfocus.com/bid/75166 - https://erpscan.io/advisories/erpscan-15-014-sap-mobile-platform-3-xxe-in-add-repository/ - http://scn.sap.com/community/secur
//erpscan.io/advisories/erpscan-15-014-sap-mobile-platform-3-xxe-in-add-repository/ - http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015 - http://seclists.org/fulldisclosure/2015/Sep/36
CVE ID: CVE-2015-5069 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-06T06:32:32.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wesnoth/wesnoth/releases/tag/1.13.1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html - https://bugzilla.redhat.com/show_bug
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html - https://bugzilla.redhat.com/show_bug.cgi?id=1236010 - https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.html - https://gna.org/bugs/?23504 - http://www.securityfocus.com/bid/75424 - http://www.openwall.com/lists/oss-security/2015/06/25/12 - https://github.com/wesnoth/wesnoth/releases/tag/1.12.3
CVE ID: CVE-2015-5070 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-06T06:32:32.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75425 - https://g
069. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75425 - https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59 - https://github.com/wesnoth/wesnoth/releases/tag/1.13.1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html - https://bugzilla.redhat.com/show_bug.cgi?id=1236010 - https://github.com/wesnoth/wesnoth/releases/tag/1.12.4 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.html - https://gna.org/bugs/?23504 - http://www.openwall.com/lists/oss-security/2015/06/25/12