Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7988 State: PUBLISHED Published: 2016-06-26T01:00:00 Last Updated: 2024-08-06T08:06:31.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036181 - https://support.apple.com/HT206846 - http://www.kb.cert.org/vuls/id/143335 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
CVE ID: CVE-2015-7989 State: PUBLISHED Published: 2016-05-22T01:00:00 Last Updated: 2024-08-06T08:06:31.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2015-7989 - https://codex.wordpress.org/Version_4.3.1 - http://www.debian.org/security/2015/dsa-3375 - https://wordpress.org/news/2015/09/wordpress-4-3-1/ - http://www.securitytrac
://www.debian.org/security/2015/dsa-3375 - https://wordpress.org/news/2015/09/wordpress-4-3-1/ - http://www.securitytracker.com/id/1033979 - http://www.debian.org/security/2015/dsa-3383 - https://github.com/WordPress/WordPress/commit/f91a5fd10ea7245e5b41e288624819a37adf290a - https://wpvulndb.com/vulnerabilities/8187
CVE ID: CVE-2015-7990 State: PUBLISHED Published: 2015-12-28T11:00:00 Last Updated: 2024-08-06T08:06:31.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html - http://lists.opensuse.org/opensu
erences: - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html - https://bugzilla.redhat.com/show_bug.cgi?id=1276437 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html - http://www.ubuntu.com/usn/USN-2887-2 - https://lkml.org/lkml/2015/10/16/530 - http://www.securitytracker.com/id/1034453 - http://www.ubuntu.com/usn/USN-2886-1 - http://www.ubuntu.com/usn/USN-2887-1 - https://bugzilla.suse.com/show_bug.cgi?id=952384 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html -
/bugzilla.suse.com/show_bug.cgi?id=952384 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html - http://www.ubuntu.com/usn/USN-2890-3 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8c7188b23474cca017b3ef354c4a58456f68303a - http://www.ubuntu.com/usn/USN-2889-1 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html - http://li
-announce/2016-02/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html - http://www.ubuntu.com/usn/USN-2889-2 - http://www.openwall.com/lists/oss-security/2015/10/27/5 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.3 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://www.ubuntu.com/usn/USN-2890-2 - http:
ttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://www.ubuntu.com/usn/USN-2890-2 - http://www.securityfocus.com/bid/77340 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html - http://www.debian.org/security/2015/dsa-3396 - https://github.com/torvalds/linux/commit/8c7188b23474cca017b3ef354c4a58456f68303a - http://www.ubuntu.com/usn/USN-2890-1 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html - http://www.ubuntu.com/usn/USN-2888-1
CVE ID: CVE-2015-7991 State: PUBLISHED Published: 2015-11-10T16:00:00 Last Updated: 2024-08-06T08:06:31.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134283/SAP-HANA-Remote-Trace-Disclosure.html - http://www.onapsis.com/research/security-advisories/SAP_HANA_Remote_Trace_Disclosure - http://seclists.org/fulldisclosure/2015/Nov/37
CVE ID: CVE-2015-7992 State: PUBLISHED Published: 2015-11-10T16:00:00 Last Updated: 2024-08-06T08:06:31.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure, aka SAP Security Note 2175928. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134284/SAP-HANA-EXECUTE_SEARCH_RULE_SET-Stored-Procedure-Memory-Corruption.html - http://www.onapsis.com/research/security-advisories/SAP_HANA_EXECUTE_SEARCH_RULE_SET_Stored_Pr
-Memory-Corruption.html - http://www.onapsis.com/research/security-advisories/SAP_HANA_EXECUTE_SEARCH_RULE_SET_Stored_Procedure_Memory_corruption - http://scn.sap.com/community/security/blog/2015/08/18/sap-security-notes-august-2015 - http://seclists.org/fulldisclosure/2015/Nov/38
CVE ID: CVE-2015-7993 State: PUBLISHED Published: 2015-11-10T16:00:00 Last Updated: 2024-08-06T08:06:31.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134286/SAP-HANA-HTTP-Login-Remote-Code-Execution.html - http://seclists.org/fulldisclosure/2015/Nov/39 - https://www.onapsis.com/blog/analyzing-sap-security-notes-september-2015 - https://www.onap
fulldisclosure/2015/Nov/39 - https://www.onapsis.com/blog/analyzing-sap-security-notes-september-2015 - https://www.onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_HTTP_based
CVE ID: CVE-2015-7994 State: PUBLISHED Published: 2015-11-10T16:00:00 Last Updated: 2024-08-06T08:06:31.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Nov/40 - http://packetstormsecurity.com/files/134287/SAP-HANA-SQL-Login-Remote-Code-Execution.html - https://www.onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_SQL_based - https://www.onapsis.com/blog/analyz
.onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_SQL_based - https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
CVE ID: CVE-2015-7995 State: PUBLISHED Published: 2015-11-17T15:00:00 Last Updated: 2024-08-06T08:06:31.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3605 - https://support.apple.com/HT206168 - https://support.apple.com/HT205731 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017 - https://support.apple.com/HT2
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017 - https://support.apple.com/HT205729 - http://www.openwall.com/lists/oss-security/2015/10/27/10 - http://www.openwall.com/lists/oss-security/2015/10/28/4 - http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html - http://www.securitytracker.com/id/1034736 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 - http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html - http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html - https://puppet.com/security/cve/cve-2015-7995 - http://lists.apple.com/archives/security-announ
2016/Mar/msg00001.html - https://puppet.com/security/cve/cve-2015-7995 - http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html - https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617 - http://www.securityfocus.com/bid/77325 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - https://support.apple.com/HT205732 - https://bugzilla.redhat.com/show_bug.cgi?id=1257962 - http://www.securitytracker.com/id/1038623
CVE ID: CVE-2015-7996 State: PUBLISHED Published: 2015-11-17T15:00:00 Last Updated: 2024-08-06T08:06:31.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow attackers to obtain credentials via the browser cache. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034167 - http://support.citrix.com/article/CTX202482
CVE ID: CVE-2015-7997 State: PUBLISHED Published: 2015-11-17T15:00:00 Last Updated: 2024-08-06T08:06:31.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034167 - http://support.citrix.com/article/CTX2
CVE Program Container: References: - http://www.securitytracker.com/id/1034167 - http://support.citrix.com/article/CTX202482
CVE ID: CVE-2015-7998 State: PUBLISHED Published: 2015-11-17T15:00:00 Last Updated: 2024-08-06T08:06:31.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034167 - http://support.citrix.com/article/CTX202482
CVE ID: CVE-2015-7999 State: PUBLISHED Published: 2016-04-14T14:00:00 Last Updated: 2024-08-06T08:06:31.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX203787 - http://www.securitytracker.com/id/1034520 - http://www.securityfocus.com/bid/79659
CVE ID: CVE-2015-8000 State: PUBLISHED Published: 2015-12-16T15:00:00 Last Updated: 2024-08-06T08:06:31.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://marc.info/?l=bugtraq&m=145680832702035&w=2 - https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/ - https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-release
/blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/ - https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174145.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174252.html - https://kb.isc.org/article/AA-01438 - http://rhn.redhat.com/errata/RHSA-2016-0079.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00035.html - http://www.ubuntu.com/usn/USN-2837-1 - http://rhn.redhat.com/errata/RHSA-2015-2655.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00027.
ttp://rhn.redhat.com/errata/RHSA-2015-2655.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00027.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174143.html - https://kb.isc.org/article/AA-01380 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966 - http://www.securityfocus.com/bid/79349 - http://marc.info/?l=bugtraq&m=145680832702035&w=2 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00042.html - http://www.securitytracker.com/id/1034418 - http://lists.opensuse.org/opensuse-security-an
ounce/2015-12/msg00042.html - http://www.securitytracker.com/id/1034418 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00034.html - http://packetstormsecurity.com/files/134882/FreeBSD-Security-Advisory-BIND-Denial-Of-Service.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174520.html - https://kb.isc.org/article/AA-01317 - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923105 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00028.html - http://rhn.redhat.com/errata/RHSA-2016-0078.html - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html - http://rhn.redhat.com/errata/
6-0078.html - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html - http://rhn.redhat.com/errata/RHSA-2015-2656.html - http://rhn.redhat.com/errata/RHSA-2015-2658.html - http://www.debian.org/security/2015/dsa-3420 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2015-8001 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html - https://phabricator.wikimedia.org/T91203
CVE ID: CVE-2015-8002 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T91205 - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
CVE ID: CVE-2015-8003 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html - https://phabricator.wikimedia.org/T91850
CVE ID: CVE-2015-8004 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T95589 - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.h
tp://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
CVE ID: CVE-2015-8005 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T108616 - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
CVE ID: CVE-2015-8006 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via the page title. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T111029 - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.html
CVE ID: CVE-2015-8007 State: PUBLISHED Published: 2015-11-09T18:00:00 Last Updated: 2024-08-06T08:06:31.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034028 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.html - https://phabricator.wikimedia.org/T110553
CVE ID: CVE-2015-8008 State: PUBLISHED Published: 2017-12-29T22:00:00 Last Updated: 2024-08-06T08:06:31.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77379 - https://bugzilla.redhat.com/show_bug.cgi?id=1273353 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170979.html - http://lists.fedoraproject.org/pipermail/package-announ
oject.org/pipermail/package-announce/2015-November/170979.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.html - http://www.securitytracker.com/id/1034028 - https://phabricator.wikimedia.org/T103022 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171007.html - http://www.openwall.com/lists/oss-security/2015/10/29/14
CVE ID: CVE-2015-8009 State: PUBLISHED Published: 2017-07-25T14:00:00 Last Updated: 2024-08-06T08:06:31.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034028 - https://phabricator.wikimedia.org/T103023 - http://www.openwall.com/lists/os
http://www.securitytracker.com/id/1034028 - https://phabricator.wikimedia.org/T103023 - http://www.openwall.com/lists/oss-security/2015/10/29/14
CVE ID: CVE-2015-8010 State: PUBLISHED Published: 2017-03-27T17:00:00 Last Updated: 2024-08-06T08:06:31.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Icinga/icinga-core/issues/1563 - http://www.openwall.com/lists/oss-security/2015/10/29/15 - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00019.html - http://www.securityfocus.com/bid/97145 - ht
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00019.html - http://www.securityfocus.com/bid/97145 - http://www.openwall.com/lists/oss-security/2015/10/23/15