Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2939 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-s
urityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T85113
CVE ID: CVE-2015-2940 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall
- http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T85858
CVE ID: CVE-2015-2941 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - https://phabricator.wikimedia.org/T85851 - http://www.securityfo
erences: - https://security.gentoo.org/glsa/201510-05 - https://phabricator.wikimedia.org/T85851 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
CVE ID: CVE-2015-2942 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/os
- https://security.gentoo.org/glsa/201510-05 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T85848
CVE ID: CVE-2015-2943 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:32:20.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honda Moto LINC 1.6.1 does not verify SSL certificates. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000065.html - http://jvn.jp/en/jp/JVN75851252/index.html
CVE ID: CVE-2015-2944 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T05:32:20.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN61328139/index.html - http://www.securityfocus.com/bid/74839 - https://issues.apache.org/jira/browse/SLING-2082 - http://jvndb.jv
index.html - http://www.securityfocus.com/bid/74839 - https://issues.apache.org/jira/browse/SLING-2082 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000069 - https://lists.apache.org/thread.html/rd2a352858630721e7b1655bbdf85e692d6156fcfe68109e12b017b16%40%3Cdev.sling.apache.org%3E - https://lists.apache.org/thread.html/r93d68359eb0ea8c0f26d71ca3998143f99209a24db7b4dacfc688cea%40%3Cdev.sling.apache.org%3E - https://lists.apache.org/thread.html/r4f41dd891a52133abdbf7f74ad1dde80c46f157c1f1cf8c23ba60a70%40%3Cdev.sling.apache.org%3E - https://lists.apache.org/thread.html/r04237d561f3e5bced0a26287454450a34275162aa6b1dbae1b707b31%40%3Cdev.sling.apache.org%3E
CVE ID: CVE-2015-2945 State: PUBLISHED Published: 2015-05-25T17:00:00 Last Updated: 2024-08-06T05:32:20.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN64459670/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067 - http://www.h-fj.com/blog/archives/2015/05/15-112843.php
CVE ID: CVE-2015-2946 State: PUBLISHED Published: 2015-05-25T19:00:00 Last Updated: 2024-08-06T05:32:20.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Open CAD Format Council SXF common library before 3.30 allows remote attackers to execute arbitrary code via a crafted CAD file. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN93976566/995630/index.html - http://www.securityfocus.com/bid/74781 - http://jvn.jp/en/jp/JVN93976566/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000068 - http://www.ocf.or.jp/top/topix/027.shtml
CVE ID: CVE-2015-2947 State: PUBLISHED Published: 2017-04-13T17:00:00 Last Updated: 2024-08-06T05:32:20.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/vu/JVNVU98282440/ - http://grabacr.net/kancolleviewer
CVE ID: CVE-2015-2948 State: PUBLISHED Published: 2015-05-31T17:00:00 Last Updated: 2024-08-06T05:32:20.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the image processor in Zenphoto before 1.4.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN68452022/index.html - http://www.zenphoto.org/news/zenphoto-1.4.8 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000070 - http://www.securityfocus.com/bid/74895
CVE ID: CVE-2015-2949 State: PUBLISHED Published: 2015-05-31T17:00:00 Last Updated: 2024-08-06T05:32:20.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ZenPhoto20 1.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN51176150/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000071 - http://www.securityfocus.com/bid/74889
CVE ID: CVE-2015-2950 State: PUBLISHED Published: 2015-06-05T10:00:00 Last Updated: 2024-08-06T05:32:20.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Brandon Bowles Open Explorer application before 0.254 Beta for Android allows remote attackers to write to arbitrary files via a crafted filename. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN95246510/index.html - http://www.securityfocus.com/bid/75022 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000072 - https://play.google.com/store/apps/details?id=org.brandroid.openmanager
CVE ID: CVE-2015-2951 State: PUBLISHED Published: 2015-06-05T10:00:00 Last Updated: 2024-08-06T05:32:20.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN06120222/index.html - http://www.securityfocus.com/bid/75021 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000073 - https://github.com/F21/jwt/commit/a327cf9052df8f9f97728ca0b5fa78a8231b79b6
CVE ID: CVE-2015-2952 State: PUBLISHED Published: 2015-06-13T15:00:00 Last Updated: 2024-08-06T05:32:20.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than CVE-2015-2953 and CVE-2015-2958. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75184 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000077 - http://jvn.jp/en/jp/JVN19732015/995646/index.html - http:
.com/bid/75184 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000077 - http://jvn.jp/en/jp/JVN19732015/995646/index.html - http://jvn.jp/en/jp/JVN19732015/index.html
CVE ID: CVE-2015-2953 State: PUBLISHED Published: 2015-06-13T15:00:00 Last Updated: 2024-08-06T05:32:20.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN16409640/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000078 - http://jvn.jp/en/jp/JVN16409640/995646/index.html - http://www.securityfocus.com/bid/75073
CVE ID: CVE-2015-2954 State: PUBLISHED Published: 2015-06-13T14:00:00 Last Updated: 2024-08-06T05:32:20.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN12241436/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000079 - http://www.securityfocus.com/bid/75072 - http://jvn.jp/en/jp/JVN12241436/995646/index.html
CVE ID: CVE-2015-2955 State: PUBLISHED Published: 2015-06-13T14:00:00 Last Updated: 2024-08-06T05:32:20.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN05559185/995646/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000080 - http://jvn.jp/en/jp/JVN05559185/index.html - http://www.securityfocus.com/bid/75074
CVE ID: CVE-2015-2956 State: PUBLISHED Published: 2015-06-13T14:00:00 Last Updated: 2024-08-06T05:32:20.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN52478686/index.html - http://jvn.jp/en/jp/JVN52478686/995646/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000081 - http://www.securityfocus.com/bid/75076
CVE ID: CVE-2015-2957 State: PUBLISHED Published: 2015-06-13T14:00:00 Last Updated: 2024-08-06T05:32:21.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000082 - http://jvn.jp/en/jp/JVN20879350/995646/index.html - http://jvn.jp/en/jp/JVN20879350/index.html - http://www.securityfocus.com/bid/75077
CVE ID: CVE-2015-2958 State: PUBLISHED Published: 2015-06-13T15:00:00 Last Updated: 2024-08-06T05:32:20.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75078 - http://jvn.jp/en/jp/JVN74280258/index.html - http://jvn.jp/en/jp/JVN74280258/995646/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000083
CVE ID: CVE-2015-2959 State: PUBLISHED Published: 2015-06-09T00:00:00 Last Updated: 2024-08-06T05:32:20.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032516 - http://jvn.jp/en/jp/JVN25598413/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075 - http://www.securityfocus.com/bid/75065 - https://support.zoho.com/portal/manageengine/helpcenter/articles/v
015-000075 - http://www.securityfocus.com/bid/75065 - https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
CVE ID: CVE-2015-2960 State: PUBLISHED Published: 2015-06-09T00:00:00 Last Updated: 2024-08-06T05:32:20.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75071 - http://www.securitytracker.com/id/1032516 - http://jvn.jp/en/jp/JVN98447310/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000074 - https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-p
0074 - https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
CVE ID: CVE-2015-2961 State: PUBLISHED Published: 2015-06-09T00:00:00 Last Updated: 2024-08-06T05:32:21.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN79284156/index.html - http://www.securitytracker.com/id/1032516 - http://www.securityfocus.com/bid/75067 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000076 - https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permission
tps://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
CVE ID: CVE-2015-2962 State: PUBLISHED Published: 2015-06-13T14:00:00 Last Updated: 2024-08-06T05:32:20.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000087 - http://jvn.jp/en/jp/JVN24336273/index.html - http://www.securityfocus.com/bid/75183
CVE ID: CVE-2015-2963 State: PUBLISHED Published: 2015-07-10T17:00:00 Last Updated: 2024-08-06T05:32:20.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75304 - https://robots.thoughtbot.com/paperclip-security-release - https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57 - h
paperclip-security-release - https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57 - http://jvn.jp/en/jp/JVN83881261/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000088 - http://openwall.com/lists/oss-security/2015/06/19/3
CVE ID: CVE-2015-2964 State: PUBLISHED Published: 2015-07-05T01:00:00 Last Updated: 2024-08-06T05:32:20.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens (JWT) header. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN25336719/index.html - http://www.securityfocus.com/bid/75423 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000090
CVE ID: CVE-2015-2965 State: PUBLISHED Published: 2015-06-28T19:00:00 Last Updated: 2024-08-06T05:32:20.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75472 - http://www.bitscope.co.jp/tep/news.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000091 - http://jvn.jp/en/jp/JVN96312698/index.html - http://www.securitytracker.com/id/1032736
CVE ID: CVE-2015-2966 State: PUBLISHED Published: 2015-06-30T15:00:00 Last Updated: 2024-08-06T05:32:20.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Droidware UK Explorer+ File Manager application before 2.3.3 for Android allows remote attackers to write to arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000093 - http://jvn.jp/en/jp/JVN77386811/index.html
CVE ID: CVE-2015-2967 State: PUBLISHED Published: 2015-07-10T15:00:00 Last Updated: 2024-08-06T05:32:21.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.cacti.net/release_notes_0_8_8d.php - http://www.securitytracker.com/id/1032672 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000094 - https://security.gentoo.org/glsa/201509-03 - http://jvn.jp/en/jp/JVN78187936/index.html
CVE ID: CVE-2015-2968 State: PUBLISHED Published: 2023-10-31T09:29:06.710Z Last Updated: 2024-09-12T19:59:35.942Z Vendors: LINE Corporation Products: LINE@ for Android, LINE@ for iOS Problem Types: Script injection Description: LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://official-blog.line.me/ja/archives/36495925.html - https://jvn.jp/en/jp/JVN22546110/
CVE ID: CVE-2015-2969 State: PUBLISHED Published: 2015-07-10T15:00:00 Last Updated: 2024-08-06T05:32:21.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000096 - http://jvn.jp/en/jp/JVN67540183/index.html - http://jvn.jp/en/jp/JVN67540183/995636/index.html
CVE ID: CVE-2015-2970 State: PUBLISHED Published: 2015-07-10T15:00:00 Last Updated: 2024-08-06T05:32:21.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000097 - http://jvn.jp/en/jp/JVN61935381/995636/index.html - http://jvn.jp/en/jp/JVN61935381/index.html
CVE ID: CVE-2015-2971 State: PUBLISHED Published: 2015-07-19T10:00:00 Last Updated: 2024-08-06T05:32:21.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - http://www.acmailer.jp/info/de.cgi?id=58 - http://jvn.jp/en/jp/JVN64051989/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000098
CVE ID: CVE-2015-2972 State: PUBLISHED Published: 2015-07-19T15:00:00 Last Updated: 2024-08-06T05:32:21.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sysphonic/thetis/commit/ce535a38ec92ff0f98af11ab41a425d1529a31ef - https://github.com/sysphonic/thetis/commit/8004ee0c384daae0b28478ff8193d1990c397f57 - https://github.com/sysphonic/thetis/commit/4ca3f5f486759660b87d7c146f1fdc11264f56eb - http://sysphonic.com/en/thetis/THETIS-SEC-001.html - ht
sphonic/thetis/commit/4ca3f5f486759660b87d7c146f1fdc11264f56eb - http://sysphonic.com/en/thetis/THETIS-SEC-001.html - https://github.com/sysphonic/thetis/commit/1b8234706e1294f41df42f3d1ccb71b983ffbe23 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000099 - https://github.com/sysphonic/thetis/commit/d9ed965075634ca1a095b480b459c68445ce951d - https://github.com/sysphonic/thetis/commit/842e44f0c2bd7d680430bb89a3bb78fd744961f9 - https://github.com/sysphonic/thetis/commit/c07e255d2296d50a0bffafaf66a76f8f1b53621f - https://github.com/sysphonic/thetis/commit/a61dc72035c7ae0b06f6d7dc8b2a848ffc7db277 - http://jvn.jp/en/jp/JVN19011483/index.html