Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3619 State: PUBLISHED Published: 2018-02-06T16:00:00 Last Updated: 2024-08-06T05:47:57.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company." Additional Analyst Notes: - CVE Program Container: References: - http://dev.virtuemart.net/projects/virtuemart/repository/diff/trunk/virtuemart/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670 - https://virtuema
art/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670 - https://virtuemart.net/news/470-release-vm3-0-8-2-secured-by-fortinet-s-fortiguard-labs - https://fortiguard.com/zeroday/FG-VD-15-027
CVE ID: CVE-2015-3620 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:47:57.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.fortiguard.com/advisory/FG-IR-15-005/ - http://seclists.org/fulldisclosure/2015/May/13 - http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-F
- http://seclists.org/fulldisclosure/2015/May/13 - http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/535452/100/0/threaded - http://www.securityfocus.com/bid/74646 - http://www.securitytracker.com/id/1032262
CVE ID: CVE-2015-3621 State: PUBLISHED Published: 2015-07-16T14:00:00 Last Updated: 2024-08-06T05:47:57.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse program. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132680/SAP-ECC-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2015/Jul/59 - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-3621/
CVE ID: CVE-2015-3622 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:47:57.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201509-04 - http://www.securitytracker.com/id/1032246 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158225.html - https://access.redhat.com/errata/RHSA-2017:1860 - http://seclists.org/fulldisclosure/2015/Apr/109 - http://ww
225.html - https://access.redhat.com/errata/RHSA-2017:1860 - http://seclists.org/fulldisclosure/2015/Apr/109 - http://www.debian.org/security/2015/dsa-3256 - https://lists.gnu.org/archive/html/help-libtasn1/2015-04/msg00000.html - http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:232 - http://lists.opensuse.org/opensuse-updates/2015-08/msg00014.html - http://packetstormsecurity.com/files/131711/libtasn1-Heap-Overflow.html - http://www.securityfocus.com/bid/74419 - http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html - http://www.ubuntu.com/usn/USN-2604-1
CVE ID: CVE-2015-3623 State: PUBLISHED Published: 2015-09-16T18:00:00 Last Updated: 2024-08-06T05:47:57.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/38118/ - http://packetstormsecurity.com/files/133499/Qlikview-11.20-SR4-Blind-XXE-Injection.html - http://www.securityfocus.com/archive/1/536411/100/0/threaded
CVE ID: CVE-2015-3624 State: PUBLISHED Published: 2015-06-09T14:00:00 Last Updated: 2024-08-06T05:47:57.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote attackers to hijack the authentication of content administrators for requests that delete content via a delete action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74937 - https://www.exploit-db.com/exploits/37296/ - http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulne
id/74937 - https://www.exploit-db.com/exploits/37296/ - http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulnerabilities-in-ektron-cms-9-10-sp1/ - http://packetstormsecurity.com/files/132104/Ektron-CMS-9.10-SP1-Cross-Site-Request-Forgery.html - http://www.securityfocus.com/archive/1/535646/100/0/threaded
CVE ID: CVE-2015-3625 State: PUBLISHED Published: 2015-07-18T00:00:00 Last Updated: 2024-08-06T05:47:57.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NVIDIA GPU driver for FreeBSD R352 before 352.09, 346 before 346.72, R349 before 349.16, R343 before 343.36, R340 before 340.76, R337 before 337.25, R334 before 334.21, R331 before 331.113, and R304 before 304.125 allows local users with certain permissions to read or write arbitrary kernel memory via unspecified vectors that trigger an untrusted pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://nvidia.custhelp.com/app/answers/detail/a_id/3693 - http://www.securitytracker.com/id/1
m Container: References: - http://nvidia.custhelp.com/app/answers/detail/a_id/3693 - http://www.securitytracker.com/id/1032981
CVE ID: CVE-2015-3626 State: PUBLISHED Published: 2015-08-11T14:00:00 Last Updated: 2024-08-06T05:47:57.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname. Additional Analyst Notes: - CVE Program Container: References: - http://www.fortiguard.com/advisory/FG-IR-15-018/ - http://www.fortiguard.com/advisory/dhcp-hostname-html-injection - http://www.securitytracker.com/id/1033144 - http://fortiguard.com/advisory/dhcp-hostname-html-injection
CVE ID: CVE-2015-3627 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T05:47:57.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - http://seclists.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://packetstormsecurity.com/files/131835
/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
CVE ID: CVE-2015-3628 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T05:47:57.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Admin
.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html - http://www.securitytracker.com/id/1034307 - https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.html - http://www.securitytracker.com/id/1034306 - http://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmd - https://www.exploit-db.com/exploits/38764/ - http://pac
tp://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmd - https://www.exploit-db.com/exploits/38764/ - http://packetstormsecurity.com/files/134434/F5-iControl-iCall-Script-Root-Command-Execution.html
CVE ID: CVE-2015-3629 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T05:47:57.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - http://seclists.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://packetstorms
.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html - http://www.securityfocus.com/bid/74558
CVE ID: CVE-2015-3630 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T05:47:57.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - http://seclists.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2
47GZrihtr-4/nwgeOOFLexIJ - http://seclists.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://www.securityfocus.com/bid/74566 - http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
CVE ID: CVE-2015-3631 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T05:47:57.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ - http://seclists.org/fulldisclosure/2015/May/28 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html - http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-In
.org/opensuse-updates/2015-05/msg00023.html - http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
CVE ID: CVE-2015-3632 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:47:57.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted GIF in a PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36859/ - http://packetstormsecurity.com/files/131685/Foxit-Reader-7.1.3.320-Memory-Corruption.html - http://www.securitytracker.com/id/1032229 - http://www.foxitsoftware.com/support/security_bulletins.php#FRD-27 - http://www.securityfocus.com/bid/74418 -
1032229 - http://www.foxitsoftware.com/support/security_bulletins.php#FRD-27 - http://www.securityfocus.com/bid/74418 - http://protekresearchlab.com/PRL-2015-05/
CVE ID: CVE-2015-3633 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:47:58.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via vectors related to digital signatures. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032228 - http://www.securityfocus.com/bid/74418 - http://www.foxitsoftware.com/support/security_bulletins.php#FRD-26
CVE ID: CVE-2015-3634 State: PUBLISHED Published: 2017-06-08T21:00:00 Last Updated: 2024-08-06T05:47:57.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74453 - https://wordpress.org/plugins/slideshow-jquery-image-gallery/#developers - http://www.openwall.com/lists/oss-security/2015/05/02/12 - https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
CVE ID: CVE-2015-3636 State: PUBLISHED Published: 2015-08-06T01:00:00 Last Updated: 2024-08-06T05:47:57.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2
ll after a disconnect. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3290 - http://www.ubuntu.com/usn/USN-2631-1 - http://www.ubuntu.com/usn/USN-2634-1 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html - http://www.ubuntu.com/usn/USN-2632-1 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html - http://www.openwall.com/lists/oss-security/2015/05/02/5 - http://www.securitytracker.com/id/1033186 - http://www.oracle.com/technetwork/
all.com/lists/oss-security/2015/05/02/5 - http://www.securitytracker.com/id/1033186 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - https://github.com/torvalds/linux/commit/a134f083e79fb4c3d0a925691e732c56911b4326 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html - http://rhn.redhat.com/errata/RHSA-2015-1643.html - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3 - https://bugzilla.redhat.com/show_bug.cgi?id=1218074 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - http://rhn.redhat.com/errata/RHSA-2015-158
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - http://rhn.redhat.com/errata/RHSA-2015-1583.html - http://rhn.redhat.com/errata/RHSA-2015-1534.html - http://rhn.redhat.com/errata/RHSA-2015-1564.html - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a134f083e79fb4c3d0a925691e732c56911b4326 - http://rhn.redhat.com/errata/RHSA-2015-1221.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157788.html - http://www.ubuntu.com/usn/USN-2633-1 - http://www.securityfocus.co
org/pipermail/package-announce/2015-May/157788.html - http://www.ubuntu.com/usn/USN-2633-1 - http://www.securityfocus.com/bid/74450
CVE ID: CVE-2015-3637 State: PUBLISHED Published: 2017-12-27T18:00:00 Last Updated: 2024-08-06T05:47:57.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL commands via the username and password parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032250 - http://www.openwall.com/lists/oss-security/2015/05/04/4
CVE ID: CVE-2015-3638 State: PUBLISHED Published: 2017-07-21T14:00:00 Last Updated: 2024-08-06T05:47:57.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032250 - http://openwall.com/lists/oss-security/2015/04/25/1 - http://www.openwall.com/lists/o
w.securitytracker.com/id/1032250 - http://openwall.com/lists/oss-security/2015/04/25/1 - http://www.openwall.com/lists/oss-security/2015/05/04/4
CVE ID: CVE-2015-3639 State: PUBLISHED Published: 2017-07-21T14:00:00 Last Updated: 2024-08-06T05:47:58.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032250 - http://openwall.com/lists/oss-security/2015/04/25/1 - http://www.openwall.com/lists/oss-security/2015/05/04/4
CVE ID: CVE-2015-3640 State: PUBLISHED Published: 2017-07-21T14:00:00 Last Updated: 2024-08-06T05:47:57.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032250 - http://www.openwall.com/lists/oss-
s: - CVE Program Container: References: - http://www.securitytracker.com/id/1032250 - http://www.openwall.com/lists/oss-security/2015/05/04/4
CVE ID: CVE-2015-3641 State: PUBLISHED Published: 2020-03-12T20:42:08 Last Updated: 2024-08-06T05:47:58.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an "Easy" attack. Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
CVE ID: CVE-2015-3642 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-06T05:47:58.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Build 55.8007.e makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). Additional Analyst Notes: - CVE Program Container: References: - http://suppo
, a variant of CVE-2014-3566 (aka POODLE). Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX200378
CVE ID: CVE-2015-3643 State: PUBLISHED Published: 2017-09-27T15:00:00 Last Updated: 2024-08-06T05:47:57.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local users to gain privileges by leveraging a missing call check_polkit for the KVMTest method. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/usn/usn-2576-2/ - https://www.exploit-db.com/exploits/36820/ - https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470 - http://
loit-db.com/exploits/36820/ - https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470 - http://www.openwall.com/lists/oss-security/2015/05/04/3 - https://usn.ubuntu.com/usn/usn-2576-1/ - http://www.securityfocus.com/bid/74304 - http://www.openwall.com/lists/oss-security/2015/04/22/12
CVE ID: CVE-2015-3644 State: PUBLISHED Published: 2015-05-14T00:00:00 Last Updated: 2024-08-06T05:47:57.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3299 - http://www.securityfocus.com/bid/74659 - https://www.stunnel.org/CVE-2015-3644.html - http://www.securitytracker.com/id/1032324
CVE ID: CVE-2015-3646 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:47:58.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs. Additional Analyst Notes: - CVE Program Container: References: - http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html - http://www.securityfocus.com/bid/74456 - https://bugs.launchpad.net/keystone/+bug/1443598 - http://www.oracle.com/technetwork/t
www.securityfocus.com/bid/74456 - https://bugs.launchpad.net/keystone/+bug/1443598 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html