Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2268 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=307382 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38466 - http://openwall.com/lists/oss-security/2015/0
p://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38466 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2269 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49144 - https://moodle.org/mod/forum/discuss.php?d=307383 - http://openwall.com/lists/oss-security/20
AD&st=commit&s=MDL-49144 - https://moodle.org/mod/forum/discuss.php?d=307383 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2270 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48804 - https://moodle.org/mod/forum/discuss.php?d=307384 - http
dle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48804 - https://moodle.org/mod/forum/discuss.php?d=307384 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2271 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49084 - https://moodle.org/mod/forum/discuss.php?d=307385 - http://openwall.
=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49084 - https://moodle.org/mod/forum/discuss.php?d=307385 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2272 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48691 - https://moodle.org/mod/forum/discuss.php?d=307386 - http://www.securityfocus.com/bid/73166 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2273 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49364 - https://moodle.org/mod/forum/discuss.php?d=307387 - http://openwall
p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49364 - https://moodle.org/mod/forum/discuss.php?d=307387 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2275 State: PUBLISHED Published: 2015-03-12T17:00:00 Last Updated: 2024-08-06T05:10:15.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Mar/65 - http://www.osvdb.org/119455 - http://www.securityfocus.com/bid/73053 - http://packetstormsecurity.com/files/130766/Community-Gallery-2.0-Cross-Site-Scripting.html - htt
yfocus.com/bid/73053 - http://packetstormsecurity.com/files/130766/Community-Gallery-2.0-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534841/100/0/threaded - http://www.itas.vn/news/itas-team-found-out-a-stored-xss-vulnerability-in-burning-board-community-gallery-77.html - http://www.exploit-db.com/exploits/36368
CVE ID: CVE-2015-2278 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T05:10:15.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Additional Analyst Notes: - CVE Program Container: Refer
, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/May/50 - http://www.securityfocus.com/bid/74643 - http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html - http://www.securityfocus.com/archive/1/535535/100/0/threaded - http://seclists.org/fulldisclosure/2015/May/96 - http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities
CVE ID: CVE-2015-2279 State: PUBLISHED Published: 2017-07-24T15:00:00 Last Updated: 2024-08-06T05:10:16.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535938/100/0/threaded - http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html - http://seclists.org/fulld
threaded - http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html - http://seclists.org/fulldisclosure/2015/Jul/29 - https://www.exploit-db.com/exploits/37532/ - http://www.securityfocus.com/bid/75559 - https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
CVE ID: CVE-2015-2280 State: PUBLISHED Published: 2017-07-24T15:00:00 Last Updated: 2024-08-06T05:10:15.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection - http://www.securityfocus.com/archive/1/535963/100/0/threaded - http://seclists.org/fulldisclosure/2015/Jul/40 - https://www.exploit-db
urityfocus.com/archive/1/535963/100/0/threaded - http://seclists.org/fulldisclosure/2015/Jul/40 - https://www.exploit-db.com/exploits/37527/ - http://www.securityfocus.com/bid/75597 - http://packetstormsecurity.com/files/132609/AirLink101-SkyIPCam1620W-OS-Command-Injection.html
CVE ID: CVE-2015-2281 State: PUBLISHED Published: 2015-03-19T14:00:00 Last Updated: 2024-08-06T05:10:16.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code via a large PROCESS_HELLO message to the Message Dispatcher on TCP port 8000. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow - http://www.securityfocus.com/archive/1/534918/100/0/threaded - http://seclists.org/fulldisclosure/2015/Mar/111 - http://www.fortiguard.com/advisory/2015-02-27
/534918/100/0/threaded - http://seclists.org/fulldisclosure/2015/Mar/111 - http://www.fortiguard.com/advisory/2015-02-27-fsso-stack-based-buffer-overflow - http://www.fortiguard.com/advisory/FG-IR-15-006/ - http://www.securityfocus.com/bid/73206 - https://www.exploit-db.com/exploits/36422/ - http://www.osvdb.org/119719
CVE ID: CVE-2015-2282 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T05:10:15.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Additional Analyst Notes: - CVE Program Conta
ied vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/May/50 - http://www.securityfocus.com/bid/74643 - http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html - http://www.securityfocus.com/archive/1/535535/100/0/threaded - http://seclists.org/fulldisclosure/2015/May/96 - http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities
CVE ID: CVE-2015-2284 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T05:10:15.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-107/
CVE ID: CVE-2015-2285 State: PUBLISHED Published: 2015-03-12T14:00:00Z Last Updated: 2024-09-17T03:33:48.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685 - http://seclists.org/fulldisclosure/2015/Mar/7 - http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/ - http://packetstorms
isclosure/2015/Mar/7 - http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/ - http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html
CVE ID: CVE-2015-2286 State: PUBLISHED Published: 2016-03-19T10:00:00 Last Updated: 2024-08-06T05:10:16.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/edx/edx-platform/commit/a1ffcc52594b1e7240501aab0ea145f1da3edb5a - https://open.edx.org/CVE-2015-2286
CVE ID: CVE-2015-2287 State: REJECTED Published: 2020-02-11T17:08:06 Last Updated: 2020-02-11T17:08:06 Description: No description available.
CVE ID: CVE-2015-2289 State: PUBLISHED Published: 2015-03-23T16:00:00 Last Updated: 2024-08-06T05:10:15.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534871/100/0/threaded - http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html - http://www.openwall.com/lists/oss-s
packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html - http://www.openwall.com/lists/oss-security/2015/03/14/1 - http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.html - https://github.com/s9y/Serendipity/commit/a30886d3bb9d8eeb6698948864c77caaa982435d - http://www.securitytracker.com/id/1031961
CVE ID: CVE-2015-2291 State: PUBLISHED Published: 2017-08-09T18:00:00.000Z Last Updated: 2025-10-21T23:55:35.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/36392/ - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&langua
tps://www.exploit-db.com/exploits/36392/ - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr - http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html - http://www.securityfocus.com/bid/79623
CVE ID: CVE-2015-2292 State: PUBLISHED Published: 2015-03-17T15:00:00 Last Updated: 2024-08-06T05:10:15.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://wpvuln
ckers to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7841 - http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html - https://yoast.com/wordpress-seo-security-release/ - https://www.exploit-db.com/exploits/36413/ - https://wordpress.org/plugins/wordpress-seo/changelog/ - http://seclists.org/fulldisclosure/2015/Mar/73 - http://www.securitytracker.com/id/1031920
CVE ID: CVE-2015-2293 State: PUBLISHED Published: 2015-03-17T15:00:00 Last Updated: 2024-08-06T05:10:15.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7841 - http://packetstormsecu
Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7841 - http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html - https://yoast.com/wordpress-seo-security-release/ - https://wordpress.org/plugins/wordpress-seo/changelog/ - http://seclists.org/fulldisclosure/2015/Mar/73 - http://www.securitytracker.com/id/1031920
CVE ID: CVE-2015-2294 State: PUBLISHED Published: 2015-04-01T14:00:00 Last Updated: 2024-08-06T05:10:16.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firewall_rules.php; (4) queue parameter in an add action to firewall_shaper.php; (5) id parameter in an edit action to services_unbound_acls.php; or (6) filterlogentries_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries_destinationipaddres
es_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries_destinationipaddress, (10) filterlogentries_interfaces, (11) filterlogentries_destinationport, (12) filterlogentries_protocolflags, or (13) filterlogentries_qty parameter to diag_logs_filter.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534987/100/0/threaded - http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - https://www.pfsense.org/security/advisories/pfSense-SA-15_03.webgui.asc - http://www.securityfocus.com/bid/73344 - https://www.htbridge.com/advisory/HTB23251 - http
pfSense-SA-15_03.webgui.asc - http://www.securityfocus.com/bid/73344 - https://www.htbridge.com/advisory/HTB23251 - https://www.exploit-db.com/exploits/36506/
CVE ID: CVE-2015-2295 State: PUBLISHED Published: 2015-04-10T14:00:00 Last Updated: 2024-08-06T05:10:16.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534987/100/0/threaded - https://www.pfsense.org/security/advisories/pfSense-SA-15_04.webgui.asc - http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross
ense.org/security/advisories/pfSense-SA-15_04.webgui.asc - http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/73344 - https://www.htbridge.com/advisory/HTB23251 - https://www.exploit-db.com/exploits/36506/
CVE ID: CVE-2015-2296 State: PUBLISHED Published: 2015-03-18T16:00:00 Last Updated: 2024-08-06T05:10:16.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/03/15/1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:133 - http://www.openwall.com/lists/oss-security/2015/03/14/4 - http://www.ubun
.com/security/advisories?name=MDVSA-2015:133 - http://www.openwall.com/lists/oss-security/2015/03/14/4 - http://www.ubuntu.com/usn/USN-2531-1 - https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc - http://advisories.mageia.org/MGASA-2015-0120.html - https://warehouse.python.org/project/requests/2.6.0/
CVE ID: CVE-2015-2297 State: PUBLISHED Published: 2017-10-06T15:00:00 Last Updated: 2024-08-06T05:10:15.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/03/15/4
CVE ID: CVE-2015-2298 State: PUBLISHED Published: 2018-01-12T17:00:00 Last Updated: 2024-08-06T05:10:15.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ether/etherpad-lite/commit/a0fb65205c7d7ff95f00eb9fd88e93b300f30c3d - https://github.com/ether/etherpad-lite/releases/tag/1.5.2 - http://www.openwall.com/lists/oss-security/2015/03/15/3
CVE ID: CVE-2015-2301 State: PUBLISHED Published: 2015-03-30T10:00:00 Last Updated: 2024-08-06T05:10:16.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3198 - http://www.ubuntu.com/usn/USN-2535-1 - http://marc.info/?l=bugtraq&m=144050155601375&w=2 - http://lis
ty/2015/dsa-3198 - http://www.ubuntu.com/usn/USN-2535-1 - http://marc.info/?l=bugtraq&m=144050155601375&w=2 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://www.securitytracker.com/id/1031949 - http://marc.info/?l=bugtraq&m=143748090628601&w=2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:079 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - https://bugzilla.redhat.com/show_bug.cgi?id=1194747 - http://marc.info/?l=bugtraq&m=143403519711434&w=2 - http://php.ne