Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-4640 State: PUBLISHED Published: 2015-06-19T14:00:00 Last Updated: 2024-08-06T06:18:12.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.nowsecure.com/keyboard-vulnerability/ - https://www.nowsecure.com/blog
CVE Program Container: References: - https://www.nowsecure.com/keyboard-vulnerability/ - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ - https://github.com/nowsecure/samsung-ime-rce-poc/ - http://www.securityfocus.com/bid/75347 - http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remote-bugging-devices/ - http://www.kb.cert.org/vuls/id/155412
CVE ID: CVE-2015-4641 State: PUBLISHED Published: 2015-06-19T14:00:00 Last Updated: 2024-08-06T06:18:12.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a ZIP archive, as demonstrated by a traversal to the /data/dalvik-cache directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.nowsecure.co
/data/dalvik-cache directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.nowsecure.com/keyboard-vulnerability/ - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ - https://github.com/nowsecure/samsung-ime-rce-poc/ - http://www.securityfocus.com/bid/75353 - http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remote-bugging-devices/ - http://www.kb.cert.org/vuls/id/155412
CVE ID: CVE-2015-4642 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032709 - http://www.securityfocus.com/bid/75290 - http://openwall.com/lists/oss-security/2015/06/18/6 - http://php.net/ChangeLog-5.p
p://www.securityfocus.com/bid/75290 - http://openwall.com/lists/oss-security/2015/06/18/6 - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69646 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=d2ac264ffea5ca2e85640b6736e0c7cd4ee9a4a9 - https://security.gentoo.org/glsa/201606-10
CVE ID: CVE-2015-4643 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - https://bugs.php.net/bug.php?id=69545 - http://www.securitytracker.com/id/1032
n.redhat.com/errata/RHSA-2015-1187.html - https://bugs.php.net/bug.php?id=69545 - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.debian.org/security/2015/dsa-3344 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://openwall.com/lists/oss-security/2015/06/18/6 - http://php.net/ChangeLog-5.php - http://www.securityfocus.com/bid/75291 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - https://security.gentoo.org/glsa/201606-10 - http://rhn.redhat.com/errata/RHSA-2015-1218.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0765623d6991b62ffcd93ddb6be8a5203a2fa7e2
CVE ID: CVE-2015-4644 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html -
52. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.debian.org/security/2015/dsa-3344 - http://www.securityfocus.com/bid/75292 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://openwall.com/lists/oss-security/2015/06/18/6 - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69667 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64 - https://security.gentoo.org/glsa/201606-10
CVE ID: CVE-2015-4645 State: PUBLISHED Published: 2017-03-17T14:00:00 Last Updated: 2024-08-06T06:18:12.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162171.html - https://bugzilla.redhat.com/show_bug.cgi?id=1234886 - https://github.com/devttys0/sasquatch/pull/5 - http://lists.fedoraproject.org/pipermail/packag
show_bug.cgi?id=1234886 - https://github.com/devttys0/sasquatch/pull/5 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162226.html - http://www.securityfocus.com/bid/75272 - https://security.gentoo.org/glsa/201701-73 - https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1
CVE ID: CVE-2015-4646 State: PUBLISHED Published: 2017-04-13T17:00:00 Last Updated: 2024-08-06T06:18:12.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75272 - https://security.gentoo.org/glsa/201701-73 - http://seclists.org/oss-sec/2015/q2/756 - https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1
CVE ID: CVE-2015-4647 State: PUBLISHED Published: 2015-07-06T14:00:00 Last Updated: 2024-08-06T06:18:12.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allow remote attackers to execute arbitrary code via a long string in the (1) FilePassword property or to the (2) GetStringInfo method. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-260/ - http://security.panasonic.com/pss/security/library/developer.html#SDK - http://www.securityfocus.com/bid/75409 - http://www.zerodayinitiative.com/advisories/ZDI
ty/library/developer.html#SDK - http://www.securityfocus.com/bid/75409 - http://www.zerodayinitiative.com/advisories/ZDI-15-259/
CVE ID: CVE-2015-4648 State: PUBLISHED Published: 2015-07-06T14:00:00 Last Updated: 2024-08-06T06:18:12.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API (PS-API) ActiveX SDK before 8.10.18 allows remote attackers to execute arbitrary code via a long string to the MulticastAddr method. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-261/ - http://security.panasonic.com/pss/security/library/developer.html#SDK - http://www.securityfocus.com/bid/75405
CVE ID: CVE-2015-4649 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-06T06:18:12.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100539 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE ID: CVE-2015-4650 State: PUBLISHED Published: 2017-10-16T18:00:00 Last Updated: 2024-08-06T06:18:12.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt - http://www.securityfocus.com/bid/76115
CVE ID: CVE-2015-4651 State: PUBLISHED Published: 2015-07-22T01:00:00 Last Updated: 2024-08-06T06:18:12.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing IP address strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=524ed1df6e6126cd63ba419ccb82c83636d77ee4 - http://www.security
ireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=524ed1df6e6126cd63ba419ccb82c83636d77ee4 - http://www.securityfocus.com/bid/75317 - http://www.debian.org/security/2015/dsa-3294 - http://lists.opensuse.org/opensuse-updates/2015-07/msg00020.html - http://www.securitytracker.com/id/1032662 - http://www.wireshark.org/security/wnpa-sec-2015-19.html - https://security.gentoo.org/glsa/201510-03 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11153 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2015-4652 State: PUBLISHED Published: 2015-07-22T01:00:00 Last Updated: 2024-08-06T06:18:12.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75316 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11201 - http://www.debian.org/security/2015/dsa-3294 - https://code.wires
://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11201 - http://www.debian.org/security/2015/dsa-3294 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d93be95fc0e7011e8b4ade9171e7e66146063296 - http://lists.opensuse.org/opensuse-updates/2015-07/msg00020.html - http://www.securitytracker.com/id/1032662 - http://www.wireshark.org/security/wnpa-sec-2015-20.html - https://security.gentoo.org/glsa/201510-03
CVE ID: CVE-2015-4654 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75261 - http://packetstormsecurity.com/files/132220/Joomla-EQ-Event-Calendar-SQL-Injection.html
CVE ID: CVE-2015-4655 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/May/109 - https://www.synology.com/en-global/releaseNote/DS214play - http://www.securityfocus.com/bid/74811 - https://www.securify.nl/advisory/SFY20150503/reflected_cross_site_scripting_in_synology_diskstation_manager
/bid/74811 - https://www.securify.nl/advisory/SFY20150503/reflected_cross_site_scripting_in_synology_diskstation_manager.html
CVE ID: CVE-2015-4656 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74816 - http://seclists.org/fulldisclosure/2015/May/110 - https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site
rg/fulldisclosure/2015/May/110 - https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html - https://www.synology.com/en-us/support/security/Photo_Station_2945
CVE ID: CVE-2015-4657 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Mailbird 2.0.16.0 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74815 - http://seclists.org/fulldisclosure/2015/May/98 - http://seclists.org/fulldisclosure/2015/May/42
CVE ID: CVE-2015-4658 State: PUBLISHED Published: 2015-06-18T18:00:00Z Last Updated: 2024-09-16T21:03:46.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37290/
CVE ID: CVE-2015-4659 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37266/ - http://www.securityfocus.com/bid/75300
CVE ID: CVE-2015-4660 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML via the id parameter to iframe.php. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt - http://www.securityfocus.com/bid/74946 - http://www.securityfocus.com/archive/1/535661/100/0/threaded - http://packetstormsecurity.com/files/132122/Enhanced-SQL-Portal-5.0.7961-Cross-Site-Scripting.html
CVE ID: CVE-2015-4661 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort parameter to system/authors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535714/100/0/threaded - http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt - http://packetstormsecurity.com/files/132193/Symphony-CMS-2.6.2-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/75059
CVE ID: CVE-2015-4664 State: PUBLISHED Published: 2018-06-18T18:00:00 Last Updated: 2024-08-06T06:18:12.232Z Vendors: CA Technologies Products: CA Privileged Access Manager Problem Types: Improper Input Validation Description: An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html
ager.html - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4665 State: PUBLISHED Published: 2015-08-13T14:00:00 Last Updated: 2024-08-06T06:18:12.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html - http://www.modzero.c
ketstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4666 State: PUBLISHED Published: 2015-08-13T14:00:00 Last Updated: 2024-08-06T06:18:12.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalatio
ess-manager.html - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4667 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T06:18:12.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple hardcoded credentials in Xsuite 2.x. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://www.securityfocus.com/archive/1/536058/100/0/threaded - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4668 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T06:18:12.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://www.securityfocus.com/archive/1/536058/100/0/threaded - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - h
ww.securityfocus.com/archive/1/536058/100/0/threaded - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4669 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T06:18:12.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html - http://www.securityfocus.com/archive/1/536058/100/0/threaded - http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt - https://www.exploit-db.com/exploits/37708/
CVE ID: CVE-2015-4670 State: PUBLISHED Published: 2015-08-18T17:00:00 Last Updated: 2024-08-06T06:18:12.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd. Additional Analyst Notes: - CVE Program Container: References: - http://www.cardinaleconcepts.com/cve-2015-4670-directory-traversal-to-remote-code-execution-in-ajaxcontroltoolkit/ - http://www.securityfocus.com/archive/1/535990/100/0/threaded
CVE ID: CVE-2015-4671 State: PUBLISHED Published: 2016-01-12T19:00:00 Last Updated: 2024-08-06T06:18:12.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Jan/17 - http://packetstormsecurity.com/files/135163/OpenCart-2.1.0.1-Cross-Site-Scripting.html - https://github.com/opencart/opencart/releases/tag/2.1.0.2 - https://github.com/opencart/opencart/commit/303fa88fe664ded4bf8753b997abd916f0a3c03f