Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2864 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T05:32:19.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/101500 - http://www.retrospect.com/support/kb/cve_2015_2864 - http://www.securityfocus.com/bid/75201 - http://www.securitytracker.com/id/1033948 - ht
t.com/support/kb/cve_2015_2864 - http://www.securityfocus.com/bid/75201 - http://www.securitytracker.com/id/1033948 - https://www.youtube.com/watch?v=MB8AL5u7JCA
CVE ID: CVE-2015-2865 State: REJECTED Published: 2015-06-19T14:00:00 Last Updated: 2015-06-19T11:57:00 Description: No description available.
CVE ID: CVE-2015-2866 State: PUBLISHED Published: 2015-07-08T14:00:00 Last Updated: 2024-08-06T05:32:19.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/40441/ - http://www.kb.cert.org/vuls/id/253708
CVE ID: CVE-2015-2867 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-06T05:32:19.772Z Vendors: Trane Products: ComfortLink II SCC firmware Problem Types: hardcoded passwords Description: A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete control of the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0028/ - http://www.securityfocus.com/bid/95120
CVE ID: CVE-2015-2868 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-06T05:32:19.763Z Vendors: Trane Products: ComfortLink II SCC firmware Problem Types: buffer overflow Description: An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95118 - http://www.talosintelligence.com/reports/TALOS-2016-0027/
CVE ID: CVE-2015-2869 State: PUBLISHED Published: 2015-07-21T15:00:00 Last Updated: 2024-08-06T05:32:19.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file. Addition
ble file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file. Additional Analyst Notes: - CVE Program Container: References: - http://blogs.cisco.com/security/talos/fileinfo-plugin-dos - http://www.securitytracker.com/id/1033004 - http://www.securityfocus.com/bid/75955 - http://totalcmd.net/plugring/fileinfo.html - http://www.kb.cert.org/vuls/id/813631
CVE ID: CVE-2015-2870 State: PUBLISHED Published: 2015-08-01T01:00:00 Last Updated: 2024-08-06T05:32:20.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/360431
CVE ID: CVE-2015-2871 State: PUBLISHED Published: 2015-08-01T01:00:00 Last Updated: 2024-08-06T05:32:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chiyu BF-660C fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify communication configuration settings via a request to net.htm, a different vulnerability than CVE-2015-5618. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/360431
CVE ID: CVE-2015-2872 State: PUBLISHED Published: 2015-08-23T15:00:00 Last Updated: 2024-08-06T05:32:20.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature. Additional Analyst Notes: - CVE Program Container: References: - http://ww
s or (2) crafted input to the widget feature. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76397 - http://esupport.trendmicro.com/solution/en-US/1112206.aspx - http://www.kb.cert.org/vuls/id/248692
CVE ID: CVE-2015-2873 State: PUBLISHED Published: 2015-08-23T15:00:00 Last Updated: 2024-08-06T05:32:20.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76396 - http://esupport.trendmicro.com/solution/en-US/1112206.a
ontainer: References: - http://www.securityfocus.com/bid/76396 - http://esupport.trendmicro.com/solution/en-US/1112206.aspx - http://www.kb.cert.org/vuls/id/248692
CVE ID: CVE-2015-2874 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:19.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a default password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/903500 - https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH - https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE ID: CVE-2015-2875 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/903500 - https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH - https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE ID: CVE-2015-2876 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/903500 - https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH - https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE ID: CVE-2015-2877 State: PUBLISHED Published: 2017-03-03T11:00:00 Last Updated: 2024-08-06T05:32:20.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as p
ation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76256 - http://www.kb.cert.org/vuls/id/935424 - http://www.antoniobarresi.com/files/cain_advisory.txt - https://www.kb.cert.org/vuls/id/BGAR-A2CNKG - https://www.kb.cert.org/vuls/id/BLUU-9ZAHZH - https://bugzilla.redhat.com/show_bug.cgi?id=1252096 - https://www.usenix.org/system/files/conference/woot15/woot15-paper-barresi.pdf
CVE ID: CVE-2015-2878 State: PUBLISHED Published: 2017-10-23T18:00:00 Last Updated: 2024-08-06T05:32:20.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist. Additional Analyst Notes: - CVE Prog
malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37686/ - http://www.securityfocus.com/archive/1/536074/100/0/threaded - http://www.securityfocus.com/archive/1/536076/100/0/threaded
CVE ID: CVE-2015-2880 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.304Z Vendors: n/a Products: TRENDnet WiFi Baby Cam TV-IP743SIC Problem Types: backdoor Description: TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2881 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.607Z Vendors: n/a Products: Gynoii Problem Types: backdoor Description: Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2882 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.209Z Vendors: n/a Products: Philips In.Sight B120/37 Problem Types: backdoor Description: Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor admin account. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2883 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.208Z Vendors: n/a Products: Philips In.Sight B120/37 Problem Types: XSS Description: Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2884 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.301Z Vendors: n/a Products: Philips In.Sight B120/37 Problem Types: DOA Description: Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors - http://www.securityfocus.com/bid/97683
CVE ID: CVE-2015-2885 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.911Z Vendors: n/a Products: Lens Peek-a-View Problem Types: backdoor Description: Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2886 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.316Z Vendors: n/a Products: iBaby M6 Problem Types: infoleak Description: iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2887 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.252Z Vendors: n/a Products: iBaby M3S Problem Types: backdoor Description: iBaby M3S has a password of admin for the backdoor admin account. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2888 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.326Z Vendors: n/a Products: Summer Baby Zoom Wifi Monitor & Internet Viewing System Problem Types: bypass authentication Description: Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2889 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T05:32:20.317Z Vendors: n/a Products: Summer Baby Zoom Wifi Monitor & Internet Viewing System Problem Types: Privilege Escalation Description: Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE ID: CVE-2015-2890 State: PUBLISHED Published: 2015-08-01T01:00:00 Last Updated: 2024-08-06T05:32:20.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BIOS implementation on Dell Latitude, OptiPlex, Precision Mobile Workstation, and Precision Workstation Client Solutions (CS) devices with model-dependent firmware before A21 does not enforce a BIOS_CNTL locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging console access, a similar issue to CVE-2015-3692. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/577140 - http://www.kb.cert.org/vuls/id/BLUU-9XXQ9L
CVE ID: CVE-2015-2894 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/377260
CVE ID: CVE-2015-2895 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the up.time client in Idera Uptime Infrastructure Monitor 7.4 might allow remote attackers to execute arbitrary code via long command input. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/377260
CVE ID: CVE-2015-2896 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, process, and event-log information via a command. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/377260
CVE ID: CVE-2015-2897 State: PUBLISHED Published: 2015-08-08T01:00:00 Last Updated: 2024-08-06T05:32:20.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/628568
CVE ID: CVE-2015-2898 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T05:32:20.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the SetGroupSequenceEx na_setgroupsequenceex function, (2) the FormatDate julptostr function, and (3) the UserFindingCodes addtocl function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securifera.com/advisories/CVE-2015-2898-2901/ - http://www.kb.cert.org/vuls/id/675052
CVE ID: CVE-2015-2899 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T05:32:20.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a long list name in a packet on port 8190. Additional Analyst Notes: - CVE Program Container: References: - http://www.securifera.com/advisories/CVE-2015-2898-2901/ - http://www.kb.cert.org/vuls/id/675052
CVE ID: CVE-2015-2900 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T05:32:20.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted packet on port 8190. Additional Analyst Notes: - CVE Program Container: References: - http://www.securifera.com/advisories/CVE-2015-2898-2901/ - http://www.kb.cert.org/vuls/id/675052
CVE ID: CVE-2015-2901 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T05:32:20.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securifera.com/advisories/CVE-2015-2898-2901/ - http://www.kb.cert.org/vuls/id/675052
CVE ID: CVE-2015-2902 State: PUBLISHED Published: 2015-11-04T02:00:00 Last Updated: 2024-08-06T05:32:20.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/350508 - http://www.securitytracker.com/id/1034078 - https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04850932
CVE ID: CVE-2015-2903 State: PUBLISHED Published: 2015-11-04T02:00:00 Last Updated: 2024-08-06T05:32:20.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/350508 - http://www.securitytracker.com/id/1034078 - https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04850932
CVE ID: CVE-2015-2904 State: PUBLISHED Published: 2015-08-23T21:00:00 Last Updated: 2024-08-06T05:32:20.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/335192
CVE ID: CVE-2015-2905 State: PUBLISHED Published: 2015-08-23T21:00:00 Last Updated: 2024-08-06T05:32:20.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/335192
CVE ID: CVE-2015-2906 State: PUBLISHED Published: 2015-08-23T21:00:00 Last Updated: 2024-08-06T05:32:20.590Z Vendors: Munic Products: Mobile Devices (MDI) OBD-II dongles Problem Types: n/a Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/woot15/workshop-program/presentation/foster - http://www.kb.cert.org
er: References: - https://www.usenix.org/conference/woot15/workshop-program/presentation/foster - http://www.kb.cert.org/vuls/id/209512