Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
om/exploits/36614/ - http://packetstormsecurity.com/files/131282/WordPress-Simple-Ads-Manager-2.5.94-File-Upload.html - https://wordpress.org/plugins/simple-ads-manager/changelog/ - http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html - http://seclists.org/fulldisclosure/2015/Apr/8
CVE ID: CVE-2015-2826 State: PUBLISHED Published: 2017-09-20T18:00:00 Last Updated: 2024-08-06T05:24:38.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535170/100/1200/threaded - http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html - https://www.exploit-db.com/exploits/36615/ - http://www.securityfocus.com/bid/73924 - http://packetstormsecurity.com/files/131281/WordPress-Simple-Ads-Manager-2.5.94-2.5.9
/www.securityfocus.com/bid/73924 - http://packetstormsecurity.com/files/131281/WordPress-Simple-Ads-Manager-2.5.94-2.5.96-Information-Disclosure.html - http://seclists.org/fulldisclosure/2015/Apr/10
CVE ID: CVE-2015-2827 State: PUBLISHED Published: 2015-04-08T01:00:00 Last Updated: 2024-08-06T05:24:38.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in CA Spectrum 9.2.x and 9.3.x before 9.3 H02 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535205/100/0/threaded - http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150407-01-security-notice-for-ca-spectrum.aspx - http://www.securityfocus.com/bid/73963 - http://packetstormsecurit
/ca20150407-01-security-notice-for-ca-spectrum.aspx - http://www.securityfocus.com/bid/73963 - http://packetstormsecurity.com/files/131330/Security-Notice-For-CA-Spectrum.html
CVE ID: CVE-2015-2828 State: PUBLISHED Published: 2015-04-08T01:00:00 Last Updated: 2024-08-06T05:24:38.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73957 - http://www.securityfocus.com/archive/1/535205/100/0/threaded - http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150407-01-security-notice-for-ca-spectrum.aspx - http://packets
product-content/recommended-reading/security-notices/ca20150407-01-security-notice-for-ca-spectrum.aspx - http://packetstormsecurity.com/files/131330/Security-Notice-For-CA-Spectrum.html
CVE ID: CVE-2015-2829 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:24:38.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e allow remote attackers to cause a denial of service (reboot) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032242 - http://www.securityfocus.com/bid/74473 - http://support.citrix.com/article/CTX200861
CVE ID: CVE-2015-2830 State: PUBLISHED Published: 2015-05-27T10:00:00 Last Updated: 2024-08-06T05:24:39.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2631-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2 - http://www.ubuntu.com
p://www.ubuntu.com/usn/USN-2631-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2 - http://www.ubuntu.com/usn/USN-2632-1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://www.securitytracker.com/id/1032413 - http://www.debian.org/security/2015/dsa-3237 - http://rhn.redhat.com/errata/RHSA-2015-1138.html - https://github.com/torvalds/linux/commit/956421fbb74c3a6261903f3836c0740187cf038b - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=956421fbb74c3a6261903f3836c0740187cf038b - http://lists.opensuse.org/opensuse-security-announ
nux-2.6.git%3Ba=commit%3Bh=956421fbb74c3a6261903f3836c0740187cf038b - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - https://bugzilla.redhat.com/show_bug.cgi?id=1208598 - http://rhn.redhat.com/errata/RHSA-2015-1137.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html - http://rhn.redhat.com/errata/RHSA-2015-1221.html - http://www.openwall.com/lists/oss-security/2015/04/02/1
CVE ID: CVE-2015-2831 State: PUBLISHED Published: 2015-04-14T18:00:00 Last Updated: 2024-08-06T05:24:39.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/02/13 - https://github.com/kmatheussen/das_watchdog/commit/bd20bb02e75e2c0483832b52f2577253febfb690 - http://www.securityfocus.com/bid/73706 - http://www.openwall.com/lists/oss-security/2015/04/01/8 - http://www.debian.org/security/2015/dsa-3221
CVE ID: CVE-2015-2838 State: PUBLISHED Published: 2015-04-03T14:00:00 Last Updated: 2024-08-06T05:24:38.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36442/ - https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_ci
/www.exploit-db.com/exploits/36442/ - https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html - http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html - http://www.securityfocus.com/archive/1/534936/100/0/threaded - http://www.securityfocus.com/bid/73358 - http://seclists.org/fulldisclosure/2015/Mar/129
CVE ID: CVE-2015-2839 State: PUBLISHED Published: 2015-04-03T14:00:00 Last Updated: 2024-08-06T05:24:38.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534935/100/0/threaded - https://www.securify.nl/advisory/SFY20140805/citrix_nitro_sdk_xen_hotfix_page_is_vulnerable_to_cross_site_scripting.html
ttps://www.securify.nl/advisory/SFY20140805/citrix_nitro_sdk_xen_hotfix_page_is_vulnerable_to_cross_site_scripting.html - http://seclists.org/fulldisclosure/2015/Mar/128 - http://packetstormsecurity.com/files/130931/Citrix-NITRO-SDK-xen_hotfix-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/73311
CVE ID: CVE-2015-2840 State: PUBLISHED Published: 2015-04-03T14:00:00 Last Updated: 2024-08-06T05:24:38.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130936/Citrix-NetScaler-VPX-Cross-Site-Scripting.html - https://www.securify.nl/advisory/SFY20140807/citrix_netscaler_vpx_help_pages_are_vulnerable_to_cross_site_scripting.html - http://www.securityfocus.com/bid/73342 - h
citrix_netscaler_vpx_help_pages_are_vulnerable_to_cross_site_scripting.html - http://www.securityfocus.com/bid/73342 - http://www.securityfocus.com/archive/1/534934/100/0/threaded - http://seclists.org/fulldisclosure/2015/Mar/130
CVE ID: CVE-2015-2841 State: PUBLISHED Published: 2015-04-03T14:00:00 Last Updated: 2024-08-06T05:24:38.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id/1031928 - https://www.exploit-db.com/exploits/36369/ - http://seclists.org/fulldisclosure/2015/Mar/95
CVE ID: CVE-2015-2842 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:24:38.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in sounds/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535319/100/1100/threaded - http://www.securityfocus.com/bid/74281 - http://goautodial.org/news/21 - h
ocus.com/archive/1/535319/100/1100/threaded - http://www.securityfocus.com/bid/74281 - http://goautodial.org/news/21 - https://www.exploit-db.com/exploits/36807/ - http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
CVE ID: CVE-2015-2843 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:24:38.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535319/100/1100/threaded - https://www.exploit-db.com/exploits/42296/ - http://www.securityfocus.com/bid/74281 - ht
ve/1/535319/100/1100/threaded - https://www.exploit-db.com/exploits/42296/ - http://www.securityfocus.com/bid/74281 - http://goautodial.org/news/21 - https://www.exploit-db.com/exploits/36807/ - http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
CVE ID: CVE-2015-2844 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:24:38.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535319/100/1100/threaded - http://www.securityfocus.com/bid/74281 - http://goautodial.org/news/21 - https://www.exploit-db.com/exploits/36807/ - http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
CVE ID: CVE-2015-2845 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:24:38.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535319/100/1100/threaded - https://www.exploit-db.com/exploits/42296/ - http://www.securityfocus.com/bid/74281 - http://goautodial.org/news/21 - https://www.exploit-db.com/exploits/36807/ - http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Inj
rg/news/21 - https://www.exploit-db.com/exploits/36807/ - http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
CVE ID: CVE-2015-2846 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:24:38.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73906 - http://www.zerodayinitiative.com/advisories/ZDI-15-115/
CVE ID: CVE-2015-2847 State: PUBLISHED Published: 2015-07-26T18:00:00 Last Updated: 2024-08-06T05:24:38.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/857948
CVE ID: CVE-2015-2848 State: PUBLISHED Published: 2015-07-26T18:00:00 Last Updated: 2024-08-06T05:24:38.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/857948
CVE ID: CVE-2015-2849 State: PUBLISHED Published: 2015-07-07T14:00:00 Last Updated: 2024-08-06T05:24:38.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/485324
CVE ID: CVE-2015-2850 State: PUBLISHED Published: 2015-07-07T14:00:00 Last Updated: 2024-08-06T05:24:38.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index-login.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices allows remote attackers to inject arbitrary web script or HTML via the msg parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/485324
CVE ID: CVE-2015-2851 State: PUBLISHED Published: 2015-05-30T19:00:00 Last Updated: 2024-08-06T05:24:38.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74826 - http://www.kb.cert.org/vuls/id/BLUU-9VBU45 - http://www.kb.cert.org/vuls/id/551972
CVE ID: CVE-2015-2852 State: PUBLISHED Published: 2015-05-30T19:00:00 Last Updated: 2024-08-06T05:24:38.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack the authentication of administrators. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/498348 - https://bto.bluecoat.com/security-advisory/sa96 - http://www.securityfocus.com/bid/74921
CVE ID: CVE-2015-2853 State: PUBLISHED Published: 2015-05-30T19:00:00 Last Updated: 2024-08-06T05:24:39.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/498348 - https://bto.bluecoat.com/security-advisory/sa96 - http://www.securityfocus.com/bid/74921
CVE ID: CVE-2015-2854 State: PUBLISHED Published: 2015-05-30T19:00:00 Last Updated: 2024-08-06T05:24:39.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/498348 - https://bto.bluecoat.com/security-advisory/sa96 - http://www.securityfocus.com/bid/74921
CVE ID: CVE-2015-2855 State: PUBLISHED Published: 2015-05-30T19:00:00 Last Updated: 2024-08-06T05:24:39.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/498348 - https://bto.bluecoat.com/security-advisory/sa96 - ht
am Container: References: - http://www.kb.cert.org/vuls/id/498348 - https://bto.bluecoat.com/security-advisory/sa96 - http://www.securityfocus.com/bid/74921
CVE ID: CVE-2015-2856 State: PUBLISHED Published: 2017-10-10T13:00:00 Last Updated: 2024-08-06T05:24:38.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/auxiliary/scanner/http/accellion_fta_statecode_file_read
CVE ID: CVE-2015-2857 State: PUBLISHED Published: 2017-08-22T15:00:00 Last Updated: 2024-08-06T05:24:39.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132665/Accellion-FTA-getStatus-verify_oauth_token-Command-Execution.html - http://www.rapid7.com/db/modules/exploit/linux/http/accellion_fta_getstatus_oauth - https://community.rapid7.com/community/metasploit/blog/2015/07/10/r7-2015-08-accellion-file-transfer-appliance-v
oauth - https://community.rapid7.com/community/metasploit/blog/2015/07/10/r7-2015-08-accellion-file-transfer-appliance-vulnerabilities-cve-2015-2856-cve-2015-2857 - https://www.exploit-db.com/exploits/37597/
CVE ID: CVE-2015-2858 State: PUBLISHED Published: 2015-10-02T01:00:00 Last Updated: 2024-08-06T05:24:38.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/693036
CVE ID: CVE-2015-2859 State: PUBLISHED Published: 2015-06-23T21:00:00 Last Updated: 2024-08-06T05:24:39.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/264092 - https://kc.mcafee.com/corporate/index?page=content&id=SB10120 - http://www.securityfocus.com/bid/75020 - http://www.security
s://kc.mcafee.com/corporate/index?page=content&id=SB10120 - http://www.securityfocus.com/bid/75020 - http://www.securitytracker.com/id/1032571 - https://kc.mcafee.com/corporate/index?page=content&id=KB84628
CVE ID: CVE-2015-2860 State: PUBLISHED Published: 2015-06-23T16:00:00 Last Updated: 2024-08-06T05:24:39.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Avigilon Control Center (ACC) 4 before 4.12.0.54 and 5 before 5.4.2.22 allows remote attackers to read arbitrary files via a crafted help/ URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75115 - http://www.kb.cert.org/vuls/id/555984
CVE ID: CVE-2015-2861 State: PUBLISHED Published: 2015-06-18T10:00:00 Last Updated: 2024-08-06T05:24:38.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75215 - http://vestacp.com/roadmap/#history - http://www.kb.cert.org/vuls/id/842780 - https://github.com/serghey-rodin/vesta/commit/527e4a9a62204be9b34c1338fadfe959b0fd3974
CVE ID: CVE-2015-2862 State: PUBLISHED Published: 2015-07-20T23:00:00 Last Updated: 2024-08-06T05:32:19.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/919604
CVE ID: CVE-2015-2863 State: PUBLISHED Published: 2015-07-20T23:00:00 Last Updated: 2024-08-06T05:32:19.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/919604