Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-4037 State: PUBLISHED Published: 2015-08-26T19:00:00 Last Updated: 2024-08-06T06:04:02.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2630-1 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html - http://www.openwall.com/lists/oss-security/2015/05/23/4 - http://lists.opensuse.org/opensuse-security-ann
sg00027.html - http://www.openwall.com/lists/oss-security/2015/05/23/4 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160414.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160058.html - http://www.openwall.com/lists/oss-security/2015/05/16/5 - http://www.debian.org/security/2015/dsa-3284 - http://www.securitytracker.com/id/1032547 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html - http://www.securityfocus.com/bid/74809 - https://bugzilla.redhat.com/show_bug.cgi?id=1222892 - http://www.openwall.com/lists/oss-security/2015/05/13/7 - http://www.debian
ugzilla.redhat.com/show_bug.cgi?id=1222892 - http://www.openwall.com/lists/oss-security/2015/05/13/7 - http://www.debian.org/security/2015/dsa-3285
CVE ID: CVE-2015-4038 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T06:04:02.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7998 - http://www.securityfocus.com/archive/1/535587/100/0/threaded - http://packetstormsecurity.com/files/132012/WordPress-WP-Membership-1.2.3-Privilege-Escalation.html - http://www.securityfocus.com/bid/74766 - http://www.securityfocus.com
ss-WP-Membership-1.2.3-Privilege-Escalation.html - http://www.securityfocus.com/bid/74766 - http://www.securityfocus.com/archive/1/535652/100/0/threaded
CVE ID: CVE-2015-4039 State: PUBLISHED Published: 2020-01-06T18:40:57 Last Updated: 2024-08-06T06:04:02.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132011/WordPress-WP-Membership-1.2.3-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/ar
ity.com/files/132011/WordPress-WP-Membership-1.2.3-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/archive/1/535586/100/0/threaded - https://www.exploit-db.com/exploits/37074/ - http://www.securityfocus.com/bid/74766
CVE ID: CVE-2015-4040 State: PUBLISHED Published: 2015-09-17T16:00:00 Last Updated: 2024-08-06T06:04:02.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133931/F5-BigIP-10.2.4-Build-595.0-HF3-Path-Traversal.html - http://www.securitytracker.com/id/1033533 - https://support.f5.com/kb/en-us/solutions/public/17000/200/sol17253.html - http://www.secur
ritytracker.com/id/1033533 - https://support.f5.com/kb/en-us/solutions/public/17000/200/sol17253.html - http://www.securitytracker.com/id/1033532
CVE ID: CVE-2015-4041 State: PUBLISHED Published: 2020-01-24T16:59:41 Last Updated: 2024-08-06T06:04:02.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/05/15/1 - https://github.com/pixelb/coreutils/commit/bea5
ner: References: - http://openwall.com/lists/oss-security/2015/05/15/1 - https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940 - https://bugzilla.suse.com/show_bug.cgi?id=928749
CVE ID: CVE-2015-4042 State: PUBLISHED Published: 2020-01-24T16:59:45 Last Updated: 2024-08-06T06:04:02.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/05/15/1 - https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940
CVE ID: CVE-2015-4043 State: PUBLISHED Published: 2018-06-19T19:00:00 Last Updated: 2024-08-06T06:04:02.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://labs.asteriskinfosec.com.au/cve/ConnX_ESP_HR.pdf
CVE ID: CVE-2015-4045 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-06T06:04:02.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74791 - https://sysdream.com/uploads/media/default/0001/01/8c6a70098657b4474fe7abe9bcdd5e73b234b610.pdf - https://www.alienvault.com/forums/discussion/5127/
CVE ID: CVE-2015-4046 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-06T06:04:02.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74795 - https://sysdream.com/uploads/media/default/0001/01/8c6a70098657b4474fe7abe9bcdd5e73b234b610.pdf - https://www.alienvault.com/forums/discussion/5127/
CVE ID: CVE-2015-4047 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T06:04:02.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3272 - http://seclists.org/fulldisclosure/2015/May/83 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159482.html - http://seclists.org/fulldisclosure/2015/May/81 - http://lists.fedoraproject.org/pipermail/package-announce/2015-J
html - http://seclists.org/fulldisclosure/2015/May/81 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159549.html - https://www.altsci.com/ipsec/ipsec-tools-sa.html - http://www.securitytracker.com/id/1032397 - http://www.openwall.com/lists/oss-security/2015/05/20/1 - http://www.securityfocus.com/bid/74739 - http://packetstormsecurity.com/files/131992/IPsec-Tools-0.8.2-Denial-Of-Service.html - http://www.ubuntu.com/usn/USN-2623-1 - http://www.openwall.com/lists/oss-security/2015/05/21/11 - https://support.f5.com/csp/article/K05013313
CVE ID: CVE-2015-4049 State: PUBLISHED Published: 2017-02-03T19:00:00 Last Updated: 2024-08-06T06:04:02.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption. Additional Analyst Notes: - CVE Program Container: References: - http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40
CVE ID: CVE-2015-4050 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T06:04:03.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. Additional Analyst Notes: - CVE Program Container: References: - http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access - http://lists.fedoraproj
Program Container: References: - http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html - http://www.debian.org/security/2015/dsa-3276 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html - http://www.securityfocus.com/bid/74928
CVE ID: CVE-2015-4051 State: PUBLISHED Published: 2015-06-08T14:00:00 Last Updated: 2024-08-06T06:04:02.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132168/Beckhoff-IPC-Diagnositcs-Authentication-Bypass.html - http://ftp.beckhof
: - http://packetstormsecurity.com/files/132168/Beckhoff-IPC-Diagnositcs-Authentication-Bypass.html - http://ftp.beckhoff.com/download/document/IndustPC/Advisory-2015-001.pdf - http://packetstormsecurity.com/files/134071/Beckoff-CX9020-CPU-Model-Remote-Code-Execution.html - http://seclists.org/fulldisclosure/2015/Jun/10 - http://www.securityfocus.com/bid/75042 - http://www.thesecurityfactory.be/permalink/beckhoff-authentication-bypass.html
CVE ID: CVE-2015-4053 State: PUBLISHED Published: 2015-06-08T14:00:00 Last Updated: 2024-08-06T06:04:02.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74775 - http://www.openwall.com/lists/oss-security/2015/04/09/9 - http://www.openwall.com/lists/oss-security/2015/05/22/1 - http://rhn.redhat.com/errata/RHSA-2015-1092.html - http://tracker.ceph.com/issues/11694
CVE ID: CVE-2015-4054 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-06T06:04:02.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pgbouncer/pgbouncer/commit/edab5be6665b9e8de66c25ba527509b229468573 - https://github.com/pgbouncer/pgbouncer/commit/74d6e5f7de5ec736f71204b7b422af7380c19ac5 - https://pgbouncer.github.io/changelog.html#pgbouncer-15x - http://www.securityfocus.com/bid/74751 - https://github.com/pgb
tps://pgbouncer.github.io/changelog.html#pgbouncer-15x - http://www.securityfocus.com/bid/74751 - https://github.com/pgbouncer/pgbouncer/issues/42 - http://www.openwall.com/lists/oss-security/2015/05/22/5 - https://security.gentoo.org/glsa/201701-24
CVE ID: CVE-2015-4056 State: PUBLISHED Published: 2017-02-21T19:00:00 Last Updated: 2024-08-06T06:04:02.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2015/Jun/91
CVE ID: CVE-2015-4057 State: PUBLISHED Published: 2017-02-21T19:00:00 Last Updated: 2024-08-06T06:04:02.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, which allows remote attackers to discover the admin user password by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2015/Jun/91
CVE ID: CVE-2015-4058 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-4059 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T06:04:02.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-245/ - http://www.securityfocus.com/bid/74860
CVE ID: CVE-2015-4060 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T06:04:02.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro allows remote attackers to execute arbitrary code via a large HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-246/ - http://www.securityfocus.com/bid/74858
CVE ID: CVE-2015-4062 State: PUBLISHED Published: 2015-05-27T18:00:00 Last Updated: 2024-08-06T06:04:02.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html - https://wordpress.org/plugins/newstatpress/changelog/ - http://www.securityfocus.com/bid/74773 - https:/
njection.html - https://wordpress.org/plugins/newstatpress/changelog/ - http://www.securityfocus.com/bid/74773 - https://www.exploit-db.com/exploits/37107/
CVE ID: CVE-2015-4063 State: PUBLISHED Published: 2015-05-27T18:00:00 Last Updated: 2024-08-06T06:04:02.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html - https://wordpress.org/plugins/newstatpress/changelog/ - http://www.securityfocus.com/b
te-Scripting-SQL-Injection.html - https://wordpress.org/plugins/newstatpress/changelog/ - http://www.securityfocus.com/bid/74773 - https://www.exploit-db.com/exploits/37107/
CVE ID: CVE-2015-4064 State: PUBLISHED Published: 2015-05-27T18:00:00 Last Updated: 2024-08-06T06:04:02.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132037/WordPress-Landing-Pages-1.8.4-Cross-Site-Scripting-SQL-Injection.html - https://wordpress.org/plugins/landing-pages/changelog/ - https://www.exploit-db.com/exp
e-Scripting-SQL-Injection.html - https://wordpress.org/plugins/landing-pages/changelog/ - https://www.exploit-db.com/exploits/37108/ - http://www.securityfocus.com/bid/74777
CVE ID: CVE-2015-4065 State: PUBLISHED Published: 2015-05-27T18:00:00 Last Updated: 2024-08-06T06:04:02.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132037/WordPress-Landing-Pages-1.8.4-Cross-Site-Scripting-SQL-Injection.html - https://wordpress.org/plugins/landing-pages/changelog/ - https://www.exploit-db.com/explo
Scripting-SQL-Injection.html - https://wordpress.org/plugins/landing-pages/changelog/ - https://www.exploit-db.com/exploits/37108/ - http://www.securityfocus.com/bid/74777
CVE ID: CVE-2015-4066 State: PUBLISHED Published: 2015-05-27T18:00:00 Last Updated: 2024-08-06T06:04:02.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132036/WordPress-GigPress-2.3.8-SQL-Injection.html - https://www.exploit-db.com/exploits/37109/ - http://www.securityfocus.com/bi
rdPress-GigPress-2.3.8-SQL-Injection.html - https://www.exploit-db.com/exploits/37109/ - http://www.securityfocus.com/bid/74747 - https://wordpress.org/plugins/gigpress/changelog/
CVE ID: CVE-2015-4067 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T06:04:02.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-240/ - http://www.securityfocus.com/bid/74841
CVE ID: CVE-2015-4068 State: PUBLISHED Published: 2015-05-29T15:00:00.000Z Last Updated: 2025-10-21T23:56:01.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-242/ - http://www.securityfocus.com/bid/74845 - http://documentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Bookshelf_Files/HTML/Update%204/UDP_
cus.com/bid/74845 - http://documentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Bookshelf_Files/HTML/Update%204/UDP_Update4_ReleaseNotes.html - http://www.zerodayinitiative.com/advisories/ZDI-15-241/
CVE ID: CVE-2015-4069 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T06:04:02.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74838 - http://documentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Bookshelf_Files/HTML/Update%204/UDP_Update4_ReleaseNotes.html - http://www.zerodayinitiative.com/advisories/ZDI-15-243/ - http://www.zerodayinitiative.
/UDP_Update4_ReleaseNotes.html - http://www.zerodayinitiative.com/advisories/ZDI-15-243/ - http://www.zerodayinitiative.com/advisories/ZDI-15-244/
CVE ID: CVE-2015-4070 State: PUBLISHED Published: 2017-05-17T14:00:00 Last Updated: 2024-08-06T06:04:02.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75047 - http://www.vapid.dhs.org/advisory.php?v=120
CVE ID: CVE-2015-4071 State: PUBLISHED Published: 2017-08-18T18:00:00 Last Updated: 2024-08-06T06:04:02.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37666/ - http://seclists.org/fulldisclosure/2015/Jul/82 - http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/
tormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/bid/75971 - http://seclists.org/fulldisclosure/2015/Jul/102
CVE ID: CVE-2015-4072 State: PUBLISHED Published: 2017-09-20T16:00:00 Last Updated: 2024-08-06T06:04:02.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37666/ - http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/bid/75971 - http://seclists.org/fulldisclosure/2015/Jul/102