Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-4073 State: PUBLISHED Published: 2017-09-20T16:00:00 Last Updated: 2024-08-06T06:04:02.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37666/ - http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfoc
packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/bid/75971 - http://seclists.org/fulldisclosure/2015/Jul/102
CVE ID: CVE-2015-4074 State: PUBLISHED Published: 2017-09-20T16:00:00 Last Updated: 2024-08-06T06:04:02.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37666/ - http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/bid/75971 - http://seclists.org/fulldisclosure/2015/Jul/102
CVE ID: CVE-2015-4075 State: PUBLISHED Published: 2017-09-20T16:00:00 Last Updated: 2024-08-06T06:04:02.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37666/ - http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html - http://www.securityfocus.com/bid/75971 - http://seclists.org/fulldisclosure/2015/Jul/102
CVE ID: CVE-2015-4077 State: PUBLISHED Published: 2015-09-03T14:00:00 Last Updated: 2024-08-06T06:04:02.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call. Additional Analyst Notes: - CVE Program Container: References: - http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities - http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html - https://www.exploit-db.com/exploits/45149/ - http://www.secur
lient-Antivirus-Information-Exposure-Access-Control.html - https://www.exploit-db.com/exploits/45149/ - http://www.securitytracker.com/id/1033439 - http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient - http://www.securityfocus.com/archive/1/536369/100/0/threaded - http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient - http://seclists.org/fulldisclosure/2015/Sep/0
CVE ID: CVE-2015-4078 State: PUBLISHED Published: 2017-03-23T20:00:00 Last Updated: 2024-08-06T06:04:02.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js
CVE ID: CVE-2015-4080 State: PUBLISHED Published: 2015-06-09T14:00:00 Last Updated: 2024-08-06T06:04:02.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132210/Kankun-Smart-Socket-Mobile-App-Hardcoded-AES-Key.html - http://www.securityfocus.com/archive/1/535702/100/0/threaded - https://plus.google.com/109112844319840106704/posts -
l - http://www.securityfocus.com/archive/1/535702/100/0/threaded - https://plus.google.com/109112844319840106704/posts - http://www.securityfocus.com/bid/75057
CVE ID: CVE-2015-4082 State: PUBLISHED Published: 2017-08-18T16:00:00 Last Updated: 2024-08-06T06:04:02.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jborg/attic/issues/271 - https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072 - http://www.openwall.com/lists/oss-security/2015/
ithub.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072 - http://www.openwall.com/lists/oss-security/2015/05/31/3 - http://www.securityfocus.com/bid/74821
CVE ID: CVE-2015-4084 State: PUBLISHED Published: 2015-05-28T14:00:00 Last Updated: 2024-08-06T06:04:02.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535615/100/0/threaded - http://www.securityfocus.com/bid/74846 - https://www.exploit-db.com/exploits/37132/ - http://packetstormsecurity.com/files/132062/WordPress-Free-Counter-1.1-Cross-Site-Scripting.h
t-db.com/exploits/37132/ - http://packetstormsecurity.com/files/132062/WordPress-Free-Counter-1.1-Cross-Site-Scripting.html
CVE ID: CVE-2015-4085 State: PUBLISHED Published: 2017-09-07T20:00:00 Last Updated: 2024-08-06T06:04:02.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/05/26/3 - https://github.com/ether/etherpad-lite/commit/5409eb314c4e072b9760b8d30b985fa0bb96a006
CVE ID: CVE-2015-4089 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T06:04:02.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-fastest-
ptions/ page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-fastest-cache/#developers - http://www.openwall.com/lists/oss-security/2015/05/26/20 - https://wpvulndb.com/vulnerabilities/9756
CVE ID: CVE-2015-4091 State: PUBLISHED Published: 2015-05-26T14:00:00 Last Updated: 2024-08-06T06:04:02.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133122/SAP-NetWeaver-AS-Java-XXE-Injection.html - https://erpscan.io/advisories/erpscan-15-013-sap-netweaver-as-java-cim-upload-xxe - http://www.securityfo
jection.html - https://erpscan.io/advisories/erpscan-15-013-sap-netweaver-as-java-cim-upload-xxe - http://www.securityfocus.com/archive/1/536239/100/0/threaded - http://www.securityfocus.com/bid/74850 - http://seclists.org/fulldisclosure/2015/May/96
CVE ID: CVE-2015-4092 State: PUBLISHED Published: 2015-05-26T14:00:00 Last Updated: 2024-08-06T06:04:02.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-15-012-sap-afaria-7-xcomms-bof - http://www.securityfocus.com/archive/1/536238/100/0/threaded - http://seclists.org/fulldisclosure/2015/May/96 - http://www.securityfocus.com/bid/74797
CVE ID: CVE-2015-4093 State: PUBLISHED Published: 2015-06-15T15:00:00 Last Updated: 2024-08-06T06:04:02.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535726/100/0/threaded - http://www.securityfocus.com/bid/75107 - http://packetstormsecurity.com/files/132232/Kibana-4.0.2-Cross-Site-Scripting.html - https://www.elastic.co/community/security/
CVE ID: CVE-2015-4094 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T06:04:02.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.info-sec.ca/advisories/Thycotic-SecretServer.html
CVE ID: CVE-2015-4100 State: PUBLISHED Published: 2017-12-21T15:00:00 Last Updated: 2024-08-06T06:04:02.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2015-4100
CVE ID: CVE-2015-4101 State: REJECTED Published: 2022-07-08T17:37:01 Last Updated: 2022-07-08T17:37:01 Description: No description available.
CVE ID: CVE-2015-4102 State: REJECTED Published: 2022-07-08T17:37:07 Last Updated: 2022-07-08T17:37:07 Description: No description available.
CVE ID: CVE-2015-4103 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T06:04:02.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2630-1 - https://support.citrix.com/article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-security-announce/
article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html - http://www.debian.org/security/2015/dsa-3284 - http://www.securitytracker.com/id/1032456 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html - http://support.citrix.com/article/CTX201145 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html - http://www.securityfocus.com/bid/74947 - http://xenbits.xen.org/xsa/advisory-128.html - https://security.gentoo.org/glsa/201604-03 - http://lists.fedoraproject.org/pipermail/package-a
/xsa/advisory-128.html - https://security.gentoo.org/glsa/201604-03 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
CVE ID: CVE-2015-4104 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T06:04:03.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2630-1 - https://support.citrix.com/article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://www.securitytracker.com/id/1032464 - ht
p://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://www.securitytracker.com/id/1032464 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html - http://www.debian.org/security/2015/dsa-3284 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html - http://support.citrix.com/article/CTX201145 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html - https://security.gentoo.org/glsa/201604-03 - http://www.securityfocus.com/bid/74950 - http://xenbits.xen.org/xsa/advisory-129.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-sec
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
CVE ID: CVE-2015-4105 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T06:04:02.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2630-1 - https://support.citrix.com/article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://lists.fedoraproject.org/pipermail/package-announ
.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html - http://www.debian.org/security/2015/dsa-3284 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html - http://support.citrix.com/article/CTX201145 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html - http://www.securityfocus.com/bid/74948 - http://xenbits.xen.org/xsa/advisory-130.html - http://www.securitytracker.com/id/1032465 - https://security.gentoo.org/glsa/201604-03 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-security-ann
sts.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
CVE ID: CVE-2015-4106 State: PUBLISHED Published: 2015-06-03T20:00:00 Last Updated: 2024-08-06T06:04:02.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2630-1 - https://support.citrix.com/article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-
upport.citrix.com/article/CTX206006 - http://www.debian.org/security/2015/dsa-3286 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html - http://www.debian.org/security/2015/dsa-3284 - http://www.securityfocus.com/bid/74949 - http://xenbits.xen.org/xsa/advisory-131.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html - http://support.citrix.com/article/CTX201145 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html - https://security.gentoo.org/glsa/201604-03 - http://www.securitytracker.com/id/1032467 - http://lists.fedoraproject.org/p
ttps://security.gentoo.org/glsa/201604-03 - http://www.securitytracker.com/id/1032467 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
CVE ID: CVE-2015-4107 State: REJECTED Published: 2020-01-14T17:06:19 Last Updated: 2020-01-14T17:06:19 Description: No description available.
CVE ID: CVE-2015-4108 State: PUBLISHED Published: 2015-06-10T18:00:00 Last Updated: 2024-08-06T06:04:02.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535681/100/0/threaded - http://packetstormsecurity.com/files/132180/Wing-FTP-4.4.6-Cross-Site-R
urityfocus.com/archive/1/535681/100/0/threaded - http://packetstormsecurity.com/files/132180/Wing-FTP-4.4.6-Cross-Site-Request-Forgery.html - http://packetstormsecurity.com/files/132179/Wing-FTP-4.4.6-Code-Execution-Cross-Site-Request-Forgery.html - http://www.securityfocus.com/archive/1/535686/100/0/threaded - http://www.wftpserver.com/serverhistory.htm - http://www.securityfocus.com/archive/1/535685/100/0/threaded
CVE ID: CVE-2015-4109 State: PUBLISHED Published: 2015-06-09T14:00:00 Last Updated: 2024-08-06T06:04:02.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75052 - http://packetstormsecurity.com/files/132181/WordPress-Users-Ultra-1.5.15-SQL-Injection.html - https://wordpress.org/plugin
tp://packetstormsecurity.com/files/132181/WordPress-Users-Ultra-1.5.15-SQL-Injection.html - https://wordpress.org/plugins/users-ultra/changelog/ - http://www.securityfocus.com/archive/1/535690/100/0/threaded
CVE ID: CVE-2015-4111 State: PUBLISHED Published: 2015-07-20T01:00:00 Last Updated: 2024-08-06T06:04:02.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file. Additional Analyst Notes: - CVE Program Container: References: - http://www.blackberry.com/btsc/KB37207 - http://www.securitytracker.com/id/1032969 - http://www.securityfocus.com/bid/75950
CVE ID: CVE-2015-4112 State: PUBLISHED Published: 2015-11-19T11:00:00 Last Updated: 2024-08-06T06:04:02.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.blackberry.com/btsc/KB37573 - http://www.securitytracker.com/id/1034154
CVE ID: CVE-2015-4116 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:04:02.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1 - http://php.net/ChangeLog-5.php - https://www.htbridge.com/advisory/HTB23
%3Bh=1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1 - http://php.net/ChangeLog-5.php - https://www.htbridge.com/advisory/HTB23262 - https://bugs.php.net/bug.php?id=69737
CVE ID: CVE-2015-4117 State: PUBLISHED Published: 2018-02-28T22:00:00 Last Updated: 2024-08-06T06:04:02.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37369/ - http://vestacp.com/roadmap/#history - https://www.htbridge.com/advisory/HTB23261
CVE ID: CVE-2015-4118 State: PUBLISHED Published: 2015-06-15T15:00:00 Last Updated: 2024-08-06T06:04:02.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535734/100/0/threaded - http://bugtracker.ispconfig.org/index.php?do=details&task_id=3898 - http://www.securityfocus.com/bid/75126 - http://packetstor
/bugtracker.ispconfig.org/index.php?do=details&task_id=3898 - http://www.securityfocus.com/bid/75126 - http://packetstormsecurity.com/files/132238/ISPConfig-3.0.5.4p6-SQL-Injection-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/37259/ - https://www.htbridge.com/advisory/HTB23260