Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7727 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133766/SAP-HANA-Trace-Configuration-SQL-Injection.html - https://www.onapsis.com/blog/analyzing-sap-secu
urity.com/files/133766/SAP-HANA-Trace-Configuration-SQL-Injection.html - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://seclists.org/fulldisclosure/2015/Sep/117 - http://packetstormsecurity.com/files/133768/SAP-HANA-getSqlTraceConfiguration-SQL-Injection.html - http://www.onapsis.com/research/security-advisories/SAP-HANA-Trace-configuration-SQL-injection - https://www.onapsis.com/research/security-advisories/sap-hana-sql-injection-getsqltraceconfiguration-function - http://seclists.org/fulldisclosure/2015/Sep/115
CVE ID: CVE-2015-7728 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Sep/116 - https://www.onapsis.com/research/security-advisories/sap-hana-xss-user-creation-through-web-based-development - https://www.onapsis.com/blog/analyzing
ch/security-advisories/sap-hana-xss-user-creation-through-web-based-development - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition
CVE ID: CVE-2015-7729 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote authenticated users to execute arbitrary XSJS code via unspecified vectors, aka SAP Security Note 2153892. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/sap-hana-xsjs-code-injection-test-net - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://packetstormsecurity.com/files/133763/SAP-H
//www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://packetstormsecurity.com/files/133763/SAP-HANA-test-net.xsjs-Code-Injection.html - http://seclists.org/fulldisclosure/2015/Sep/112
CVE ID: CVE-2015-7730 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet, aka SAP Security Note 2001108. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/SAP-Business-Objects-Memory-Corruption - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://www.securitytracker.com/id/1033637 - ht
ps://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://www.securitytracker.com/id/1033637 - http://seclists.org/fulldisclosure/2015/Sep/81
CVE ID: CVE-2015-7731 State: PUBLISHED Published: 2021-08-09T18:03:12 Last Updated: 2024-08-06T07:58:59.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/SAP-Mobile-Platform-DataVault-Keystream-Recovery - https://seclists.org/bugtraq/2015/Aug/39
CVE ID: CVE-2015-7732 State: PUBLISHED Published: 2017-06-15T14:00:00 Last Updated: 2024-08-06T07:58:59.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.info-sec.ca/advisories/Avira-Mobile-Security.html
CVE ID: CVE-2015-7740 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T07:58:59.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) via vectors involving an application that passes crafted input to the GPU driver. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-460486.htm
CVE ID: CVE-2015-7743 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T07:58:59.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/137255/Paessler-PRTG-Network-Monitor-14.4.12.3282-XXE-Injection.html - https://www.paessler.com/prtg/history/stable#16.2.23.3077
CVE ID: CVE-2015-7744 State: PUBLISHED Published: 2016-01-22T15:00:00 Last Updated: 2024-08-06T07:58:59.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00015.html - http://www.securitytracker.com/id/1034708 - http://wolf
.opensuse.org/opensuse-security-announce/2016-02/msg00015.html - http://www.securitytracker.com/id/1034708 - http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html - https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html - https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/ - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00016
oring-rsa-keys-with-tls-perfect-forward-secrecy/ - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00016.html
CVE ID: CVE-2015-7746 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-06T07:58:59.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/index?page=content&id=9010049
CVE ID: CVE-2015-7747 State: PUBLISHED Published: 2020-02-19T20:27:49 Last Updated: 2024-08-06T07:58:59.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2787-1 - https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721 - http://www.openwall.com/lists/oss-security/2015/10/06/2 - http://l
launchpad.net/ubuntu/+source/audiofile/+bug/1502721 - http://www.openwall.com/lists/oss-security/2015/10/06/2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170387.html - https://www.openwall.com/lists/oss-security/2015/10/08/1 - https://github.com/ccrisan/motioneyeos/blob/master/package/audiofile/0008-CVE-2015-7747.patch
CVE ID: CVE-2015-7748 State: PUBLISHED Published: 2015-10-19T18:00:00 Last Updated: 2024-08-06T07:58:59.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101103 - http://www.securitytracker.com/id/1033858 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10701
CVE ID: CVE-2015-7749 State: PUBLISHED Published: 2015-10-19T18:00:00 Last Updated: 2024-08-06T07:58:59.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS." Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033856 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10703
CVE ID: CVE-2015-7750 State: PUBLISHED Published: 2015-10-19T18:00:00 Last Updated: 2024-08-06T07:58:59.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cause a denial of service via a crafted L2TP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033832 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10704
CVE ID: CVE-2015-7751 State: PUBLISHED Published: 2015-10-19T18:00:00 Last Updated: 2024-08-06T07:59:00.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain
5.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033817 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10707
CVE ID: CVE-2015-7752 State: PUBLISHED Published: 2015-10-19T18:00:00 Last Updated: 2024-08-06T07:58:59.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH server in Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D25, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D20 allows remote attackers to cause a denial of service (CPU consumption) via unspecified SSH traffic. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.ne
tion) via unspecified SSH traffic. Additional Analyst Notes: - CVE Program Container: References: - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10708 - http://www.securitytracker.com/id/1033818
CVE ID: CVE-2015-7754 State: PUBLISHED Published: 2016-01-08T19:00:00 Last Updated: 2024-08-06T07:59:00.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/79627 - http://www.securitytracker.com/id/1034490 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10712
CVE ID: CVE-2015-7755 State: PUBLISHED Published: 2015-12-19T11:00:00.000Z Last Updated: 2025-10-21T23:55:56.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://arstechni
LNET session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/ - http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/ - http://www.securitytracker.com/id/1034489 - http://www.kb.cert.org/vuls/id/640184 - https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 - https://github.com/hdm/juniper-cve-2015-7755 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713 - http://twitter.com/cryptoron/statuses/677900647560253442 - https://adamca
et/InfoCenter/index?page=content&id=JSA10713 - http://twitter.com/cryptoron/statuses/677900647560253442 - https://adamcaudill.com/2015/12/17/much-ado-about-juniper/ - http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear/ - http://www.securityfocus.com/bid/79626
CVE ID: CVE-2015-7756 State: PUBLISHED Published: 2015-12-19T11:00:00 Last Updated: 2024-08-06T07:58:59.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack. Additional Analyst Notes: - CV
sniffing the network for ciphertext data and conducting an unspecified decryption attack. Additional Analyst Notes: - CVE Program Container: References: - http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/ - http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/ - http://www.securitytracker.com/id/1034489 - http://www.kb.cert.org/vuls/id/640184 - https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 - https://github.com/hdm/juniper-cve-2015-7755 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713 - https://adamcaudill.co
com/hdm/juniper-cve-2015-7755 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713 - https://adamcaudill.com/2015/12/17/much-ado-about-juniper/ - http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear/
CVE ID: CVE-2015-7757 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-7758 State: PUBLISHED Published: 2016-01-08T19:00:00 Last Updated: 2024-08-06T07:58:59.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756432 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00117.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178582
org/opensuse-updates/2015-12/msg00117.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178582.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00150.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178642.html - http://www.openwall.com/lists/oss-security/2015/10/08/5 - http://www.openwall.com/lists/oss-security/2015/10/08/4
CVE ID: CVE-2015-7759 State: PUBLISHED Published: 2016-01-12T20:00:00 Last Updated: 2024-08-06T07:58:59.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets, related to Path MTU (PMTU) discovery. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034627 - https://support.f5.com/kb/en-us/solutions/public/k/22/sol22843911.html
CVE ID: CVE-2015-7760 State: PUBLISHED Published: 2015-10-09T01:00:00 Last Updated: 2024-08-06T07:58:59.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections, which allows remote attackers to cause a denial of service (resource consumption) by repeatedly connecting to the SSH port, a different vulnerability than CVE-2015-7761. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033703 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - https://support.apple.com/HT205267 - http://www.securityfocus.co
com/archives/security-announce/2015/Sep/msg00008.html - https://support.apple.com/HT205267 - http://www.securityfocus.com/bid/76908
CVE ID: CVE-2015-7761 State: PUBLISHED Published: 2015-10-09T01:00:00 Last Updated: 2024-08-06T07:58:59.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - https://support.apple.com/HT205267 - http://www.securityfocus.com/bid/76908
CVE ID: CVE-2015-7762 State: PUBLISHED Published: 2015-11-06T21:00:00 Last Updated: 2024-08-06T07:58:59.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://www.openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15 - https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txt - https://lists.openafs.org/pipermail/openafs-a
-1.6.15 - https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txt - https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html - http://www.securitytracker.com/id/1034039 - http://www.debian.org/security/2015/dsa-3387
CVE ID: CVE-2015-7763 State: PUBLISHED Published: 2015-11-06T21:00:00 Last Updated: 2024-08-06T07:59:00.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://www.openafs.org/dl/openafs/1.6.15/RELNOTES-1.6.15 - https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txt - https://lists.openafs.org/pipermail/openafs
ES-1.6.15 - https://www.openafs.org/pages/security/OPENAFS-SA-2015-007.txt - https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html - http://www.securitytracker.com/id/1034039 - http://www.debian.org/security/2015/dsa-3387
CVE ID: CVE-2015-7764 State: PUBLISHED Published: 2017-08-09T16:00:00 Last Updated: 2024-08-06T07:58:59.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/lemur/issues/117 - http://www.openwall.com/lists/oss-security/2015/10/20/3 - https://github.com/kvesteri/sqlalchemy-utils/issues/166
CVE ID: CVE-2015-7765 State: PUBLISHED Published: 2015-10-09T14:00:00Z Last Updated: 2024-09-17T02:46:53.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password. Additional Analyst Notes: - CVE Program Container: References: - https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability - http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce - http://seclists.org/fulldisclosure/2015
p://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce - http://seclists.org/fulldisclosure/2015/Sep/66 - http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/38221/
CVE ID: CVE-2015-7766 State: PUBLISHED Published: 2015-10-09T14:00:00Z Last Updated: 2024-09-17T01:10:42.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." Additional Analyst Notes: - CVE Program Container: References: - https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability - http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce - http://seclists.org/fulldisclosure/2015/Sep/66