Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2153 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T05:10:14.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU). Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of
www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html - http://www.securityfocus.com/bid/73018 - https://access.redhat.com/errata/RHSA-2017:1871 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.securitytracker.com/id/1031937 - https://security.gentoo.org/glsa/201510-04 - https://www.exploit-db.com/exploits/37663/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153999.html - http://advisories.mageia.org/MGASA-2015-0114.html - http://www.ubuntu.com/usn/USN-2580-1 - http://www.securityfocus.com/archive/1/534829/100/0/threaded - http:/
0114.html - http://www.ubuntu.com/usn/USN-2580-1 - http://www.securityfocus.com/archive/1/534829/100/0/threaded - http://lists.opensuse.org/opensuse-updates/2015-03/msg00084.html - https://bugzilla.redhat.com/show_bug.cgi?id=1201795 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:182 - http://www.debian.org/security/2015/dsa-3193
CVE ID: CVE-2015-2154 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T05:10:14.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1201797 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://pac
l/package-announce/2015-March/153834.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html - https://access.redhat.com/errata/RHSA-2017:1871 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.securitytracker.com/id/1031937 - https://security.gentoo.org/glsa/201510-04 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153999.html - http://advisories.mageia.org/MGASA-2015-0114.html - http://www.securityfocus.com/bid/73017 - http://www.ubuntu.com/usn/USN-2580-1 - http://www.securityfocus.com/archive/1/534829/100/0/threaded -
s.com/bid/73017 - http://www.ubuntu.com/usn/USN-2580-1 - http://www.securityfocus.com/archive/1/534829/100/0/threaded - http://lists.opensuse.org/opensuse-updates/2015-03/msg00084.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:182 - http://www.debian.org/security/2015/dsa-3193
CVE ID: CVE-2015-2155 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T05:10:14.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1201798 - http://www.securityfocus.com/bid/73021 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://packetstormsecurity.com/files/130730/tcpdump-Denial-
//www.mandriva.com/security/advisories?name=MDVSA-2015:125 - http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html - https://access.redhat.com/errata/RHSA-2017:1871 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.securitytracker.com/id/1031937 - https://security.gentoo.org/glsa/201510-04 - http://advisories.mageia.org/MGASA-2015-0114.html - http://www.ubuntu.com/usn/USN-2580-1 - http://www.securityfocus.com/archive/1/534829/100/0/threaded - http://lists.opensuse.org/opensuse-updates/2015-03/msg00084.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:182 - http://www.debian.org/security/2015/dsa-
g00084.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:182 - http://www.debian.org/security/2015/dsa-3193
CVE ID: CVE-2015-2156 State: PUBLISHED Published: 2017-10-18T15:00:00 Last Updated: 2024-08-06T05:10:14.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. Additional Analyst Notes: - CVE Program Container: References: - http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html - https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass - http://l
08/3-9-8-Final-and-3.html - https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html - https://bugzilla.redhat.com/show_bug.cgi?id=1222923 - https://github.com/netty/netty/pull/3754 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html - http://www.securityfocus.com/bid/74704 - http://www.openwall.com/lists/oss-security/2015/05/17/1 - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3C
lsar.apache.org%3E - https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2015-2157 State: PUBLISHED Published: 2015-03-27T14:00:00 Last Updated: 2024-08-06T05:10:14.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html - http://www.securityfocus.com/bid/72825 - http://www.debian.org/security/2015/dsa-3190 - http://li
15-March/151933.html - http://www.securityfocus.com/bid/72825 - http://www.debian.org/security/2015/dsa-3190 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html - http://www.openwall.com/lists/oss-security/2015/02/28/4 - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html - http://www.openwall.com/lists/oss-security/2015/02/28/5 - http://lists.opensuse.org/opensuse-updates/2015-03/msg00032.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151839.html
CVE ID: CVE-2015-2158 State: PUBLISHED Published: 2017-10-06T15:00:00 Last Updated: 2024-08-06T05:10:14.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/ - http://www.securityfocus.com/bid/72830 - http://www.openwall.com/lists/oss-security/2015/03/01/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1198171
CVE ID: CVE-2015-2165 State: PUBLISHED Published: 2015-04-06T15:00:00 Last Updated: 2024-08-06T05:10:15.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) portal, (2) fromDate, (3) toDate, (4) fromTime, (5) toTime, (6) kword, (7) uname, (8) pname, (9) sname, (10) atype, or (11) atitle parameter to top-links.jsp; (12) portal or (13) uid parameter to (a) page-summary.jsp or (b) service-summary.jsp; (14) portal, (15) fromDate, (16) toDate, (17) fromTime, (18) toT
ter to (a) page-summary.jsp or (b) service-summary.jsp; (14) portal, (15) fromDate, (16) toDate, (17) fromTime, (18) toTime, (19) sortDirection, (20) kword, (21) uname, (22) pname, (23) sname, (24) file, (25) atype, or (26) atitle parameter to (c) top-useragent-devices.jsp or (d) top-interest-areas.jsp; (27) fromDate, (28) toDate, (29) fromTime, (30) toTime, (31) sortDirection, (32) kword, (33) uname, (34) pname, (35) sname, (36) file, (37) atype, or (38) atitle parameter to top-message-services.jsp; (39) portal, (40) fromDate, (41) toDate, (42) fromTime, (43) toTime, (44) orderBy, (45) sortDirection, (46) kword, (47) uname, (48) pname, (49) sname, (50) file, (51) atype, or (52) atitle param
orderBy, (45) sortDirection, (46) kword, (47) uname, (48) pname, (49) sname, (50) file, (51) atype, or (52) atitle parameter to (e) user-statistics.jsp, (f) top-web-pages.jsp, (g) top-devices.jsp, (h) top-pages.jsp, (i) session-summary.jsp, (j) top-providers.jsp, (k) top-modules.jsp, or (l) top-services.jsp; (53) fromDate, (54) toDate, (55) fromTime, (56) toTime, (57) orderBy, (58) sortDirection, (59) uid, (60) uid2, (61) kword, (62) uname, (63) pname, (64) sname, (65) file, (66) atype, or (67) atitle parameter to message-shortcode-summary.jsp; (68) fromDate, (69) toDate, (70) fromTime, (71) toTime, (72) orderBy, (73) sortDirection, (74) uid, (75) kword, (76) uname, (77) pname, (78) sname, (
70) fromTime, (71) toTime, (72) orderBy, (73) sortDirection, (74) uid, (75) kword, (76) uname, (77) pname, (78) sname, (79) file, (80) atype, or (81) atitle parameter to (m) message-providers-summary.jsp or (n) message-services-summary.jsp; (82) kword, (83) uname, (84) pname, (85) sname, (86) file, (87) atype, or (88) atitle parameter to license-summary.jsp; (89) portal, (90) fromDate, (91) toDate, (92) fromTime, (93) toTime, (94) orderBy, (95) sortDirection, (96) uid, (97) uid2, (98) kword, (99) uname, (100) pname, (101) sname, (102) file, (103) atype, or (104) atitle parameter to useragent-device-summary.jsp; (105) fromDate, (106) toDate, (107) fromTime, (108) toTime, (109) orderBy, (110)
meter to useragent-device-summary.jsp; (105) fromDate, (106) toDate, (107) fromTime, (108) toTime, (109) orderBy, (110) sortDirection, (111) kword, (112) uname, (113) pname, (114) sname, (115) file, (116) atype, or (117) atitle parameter to (o) top-message-providers.jsp, (p) top-message-devices.jsp, (q) top-message-assets.jsp, (r) top-message-downloads.jsp, or (s) top-message-shortcode.jsp; (118) fromDate, (119) toDate, (120) fromTime, (121) toTime, (122) kword, (123) uname, (124) pname, (125) sname, (126) file, (127) atype, or (128) atitle parameter to request-summary.jsp; (129) portal parameter to link-summary-select.jsp, (130) provider-summary-select.jsp, or (131) module-summary-select.js
(129) portal parameter to link-summary-select.jsp, (130) provider-summary-select.jsp, or (131) module-summary-select.jsp; (132) portal, (133) uid, (134) kword, (135) uname, (136) pname, (137) sname, (138) file, (139) atype, or (140) atitle parameter to link-summary.jsp; (141) portal, (142) fromDate, (143) toDate, (144) fromTime, (145) toTime, (146) orderBy, (147) sortDirection, (148) uid, (149) kword, (150) uname, (151) pname, (152) sname, (153) file, (154) atype, or (155) atitle parameter to (t) provider-summary.jsp or (u) module-summary.jsp in reports/pages/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73933 - http://packetstormsecurit
Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73933 - http://packetstormsecurity.com/files/131232/Ericsson-Drutt-MSDP-Report-Viewer-Cross-Site-Scripting.html
CVE ID: CVE-2015-2166 State: PUBLISHED Published: 2015-04-06T15:00:00 Last Updated: 2024-08-06T05:10:14.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131233/Ericsson-Drutt-MSDP-Instance-Monitor-Directory-Traversal-File-Access.html - http://www.securityfocus.com/bid/73901 - https://www.exploit-db.com/exploits/36619/
CVE ID: CVE-2015-2167 State: PUBLISHED Published: 2015-04-06T15:00:00 Last Updated: 2024-08-06T05:10:14.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to jsp/start-3pi-manager.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131230/Ericsson-Drutt-MSDP-3PI-Manager-Open-Redirect.html - http://www.securityfocus.com/bid/73934
CVE ID: CVE-2015-2168 State: REJECTED Published: 2015-03-03T11:00:00 Last Updated: 2015-03-03T05:57:00 Description: No description available.
CVE ID: CVE-2015-2169 State: PUBLISHED Published: 2015-06-24T14:00:00 Last Updated: 2024-08-06T05:10:16.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37395/ - http://packetstormsecurity.com/files/132433/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/75389 - http://seclists.org/fulld
Engine-Asset-Explorer-6.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/75389 - http://seclists.org/fulldisclosure/2015/Jun/74 - http://techtootech.blogspot.in/2015/06/found-xss-vulnerability-in-manage.html
CVE ID: CVE-2015-2170 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:14.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2594-1 - https://security.gentoo.org/glsa/201512-08 - http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html - http://www.securityfocus.com/bid/74443 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html
CVE ID: CVE-2015-2171 State: PUBLISHED Published: 2015-03-30T14:00:00 Last Updated: 2024-08-06T05:10:15.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70087 - https://github.com/slimphp/Slim/issues/1034 - http://www.slimframework.com/2015/03/01/version-260.html - http://seclists.org/fulldisclosure/2015/Mar/16
CVE ID: CVE-2015-2172 State: PUBLISHED Published: 2015-03-30T14:00:00 Last Updated: 2024-08-06T05:10:14.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/splitbrain/dokuwiki/issues/1056 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html - https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f - https://www.do
ch/153266.html - https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f - https://www.dokuwiki.org/changes - http://www.securityfocus.com/bid/72827 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.html - http://www.openwall.com/lists/oss-security/2015/03/02/2 - http://advisories.mageia.org/MGASA-2015-0093.html
CVE ID: CVE-2015-2177 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T05:10:14.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-064-04 - http://www.securitytracker.com/id/1032040 - https://www.exploit-db.com/exploits/44802/ - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-987029.pdf - http://www.securityfocus.com/bid/72973 - https://c
n/pool/de/forschungsfelder/siemens_security_advisory_ssa-987029.pdf - http://www.securityfocus.com/bid/72973 - https://cert-portal.siemens.com/productcert/pdf/ssa-987029.pdf
CVE ID: CVE-2015-2178 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-2179 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-06T05:10:14.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapid.dhs.org/advisory.php?v=115
CVE ID: CVE-2015-2180 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-06T05:10:15.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96387 - https://github.com/roundcube/roundcubemail/issues/4757
CVE ID: CVE-2015-2181 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-06T05:10:16.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96391 - https://github.com/roundcube/roundcubemail/issues/4757
CVE ID: CVE-2015-2182 State: PUBLISHED Published: 2015-03-11T14:00:00 Last Updated: 2024-08-06T05:10:15.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322. Additional Analyst Notes: - CVE Program Container: References: - http://secpod.org/advisories/SECPOD_ZeusCart_XSS.txt - http://seclists.org/oss-sec/2015/q1/727 - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html - ht
Cart_XSS.txt - http://seclists.org/oss-sec/2015/q1/727 - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html - http://www.securityfocus.com/bid/72761 - http://osvdb.org/show/osvdb/68756 - http://seclists.org/oss-sec/2015/q1/649 - http://www.exploit-db.com/exploits/36159 - http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Feb/89 - http://secpod.org/blog/?p=109 - https://github.com/ZeusCart/zeuscart/issues/28
CVE ID: CVE-2015-2183 State: PUBLISHED Published: 2015-03-10T14:00:00 Last Updated: 2024-08-06T05:10:16.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2015/q1/727 - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html - http://www.securityfocus.com/bid/72761 - http://seclists.org/oss-sec/2015/q1/649 -
pot.de/2015/01/sroeadv-2015-12.html - http://www.securityfocus.com/bid/72761 - http://seclists.org/oss-sec/2015/q1/649 - http://www.exploit-db.com/exploits/36159 - http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Feb/89 - https://github.com/ZeusCart/zeuscart/issues/28
CVE ID: CVE-2015-2184 State: PUBLISHED Published: 2015-03-10T14:00:00 Last Updated: 2024-08-06T05:10:15.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2015/q1/727 - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html - http://www.securityfocus.com/bid/72761 - http://seclists.org/oss-sec/2015/q1/649 - http://www.exploit-db.com/exploits/36159 - http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html - h
.com/exploits/36159 - http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Feb/89 - https://github.com/ZeusCart/zeuscart/issues/28
CVE ID: CVE-2015-2186 State: PUBLISHED Published: 2018-02-03T00:00:00 Last Updated: 2024-08-06T05:10:15.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed. Additional Analyst Notes: - CVE Program Container: References: - https://open.edx.org/CVE-2015-2186 - https://github.com/edx/configuration/pull/1885/files