Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3406 State: PUBLISHED Published: 2019-11-29T20:42:53 Last Updated: 2024-08-06T05:47:57.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/07/1 - http://www.openwall.com/lists/oss-security/2015/04/23/17 - https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - https://metacpan.org/changes/distribution/Module-Signature - h
gnature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - https://metacpan.org/changes/distribution/Module-Signature - http://ubuntu.com/usn/usn-2607-1
CVE ID: CVE-2015-3407 State: PUBLISHED Published: 2015-05-19T18:00:00 Last Updated: 2024-08-06T05:47:57.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/changes/distribution/Module-Signature - http://www.debian.org/security/2015/dsa-3261 - http://www.openwall.com/lists/oss-security/2015/04/07/1 - https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - http://www.openwall.com/lists/oss-security/2015/04/23/17 -
-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - http://www.openwall.com/lists/oss-security/2015/04/23/17 - http://ubuntu.com/usn/usn-2607-1
CVE ID: CVE-2015-3408 State: PUBLISHED Published: 2015-05-19T18:00:00 Last Updated: 2024-08-06T05:47:57.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/changes/distribution/Module-Signature - http://www.debian.org/security/2015/dsa-3261 - http://www.openwall.com/lists/oss-security/2015/04/07/1 - https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - http://w
ty/2015/04/07/1 - https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f - http://www.openwall.com/lists/oss-security/2015/04/23/17 - http://ubuntu.com/usn/usn-2607-1
CVE ID: CVE-2015-3409 State: PUBLISHED Published: 2015-05-19T18:00:00 Last Updated: 2024-08-06T05:47:57.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/changes/distribution/Module-Signature - http://www.debian.org/security/2015/dsa-3261 - http://www.openwall.com/lists/oss-security/2015/04/07/1 - https://github.com/audreyt/module-signature/commit/c41e8885b862b9fce2719449bc9
all.com/lists/oss-security/2015/04/07/1 - https://github.com/audreyt/module-signature/commit/c41e8885b862b9fce2719449bc9336f0bea658ef - http://www.openwall.com/lists/oss-security/2015/04/23/17 - http://www.securityfocus.com/bid/73937 - http://ubuntu.com/usn/usn-2607-1
CVE ID: CVE-2015-3411 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T05:47:57.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files. Additional Analyst Notes: - CVE Prog
bypasses an intended configuration in which client users may read only .xml files. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - https://bugs.php.net/bug.php?id=69353 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=4435b9142ff9813845d5c97ab29a5d637bedb257 - http://php.net/ChangeLog-5.php - http://www.securityfocus.com/bid/75255 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-3412 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T05:47:57.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.red
files with only one specific extension. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - https://bugs.php.net/bug.php?id=69353 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=4435b9142ff9813845d5c97ab29a5d637bedb257 - http://php.net/ChangeLog-5.php - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://www.securityfocus.com/bid/75250 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-3414 State: PUBLISHED Published: 2015-04-24T17:00:00 Last Updated: 2024-08-06T05:47:57.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1635.html - http://www.securitytracker.com/id/1033703 - http://www.oracle.
ces: - http://rhn.redhat.com/errata/RHSA-2015-1635.html - http://www.securitytracker.com/id/1033703 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securityfocus.com/bid/74228 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - https://security.gentoo.org/glsa/201507-05 - http://www.ubuntu.com/usn/USN-2698-1 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://support.apple.com/HT205267 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html - https://www.sqlite.org/src/info/eddc05e7bb31fae74daa86e0504a3478b99fa0f2 - http://www.mandriva.com/security/advisories?name=MDV
/www.sqlite.org/src/info/eddc05e7bb31fae74daa86e0504a3478b99fa0f2 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:217 - https://support.apple.com/HT205213 - http://www.debian.org/security/2015/dsa-3252 - http://seclists.org/fulldisclosure/2015/Apr/31
CVE ID: CVE-2015-3415 State: PUBLISHED Published: 2015-04-24T17:00:00 Last Updated: 2024-08-06T05:47:57.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1635.html - http://www.securitytracker.com/id/1033703 - http://www.oracle.com/technetwork/
n.redhat.com/errata/RHSA-2015-1635.html - http://www.securitytracker.com/id/1033703 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securityfocus.com/bid/74228 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - https://security.gentoo.org/glsa/201507-05 - http://www.ubuntu.com/usn/USN-2698-1 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://support.apple.com/HT205267 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html - https://www.sqlite.org/src/info/02e3c88fbf6abdcf3975fb0fb71972b0ab30da30 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:217 - ht
src/info/02e3c88fbf6abdcf3975fb0fb71972b0ab30da30 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:217 - https://support.apple.com/HT205213 - http://www.debian.org/security/2015/dsa-3252 - http://seclists.org/fulldisclosure/2015/Apr/31
CVE ID: CVE-2015-3416 State: PUBLISHED Published: 2015-04-24T17:00:00 Last Updated: 2024-08-06T05:47:57.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1634.html - http://rhn.redhat.com/erra
es: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1634.html - http://rhn.redhat.com/errata/RHSA-2015-1635.html - http://www.securitytracker.com/id/1033703 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securityfocus.com/bid/74228 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - https://security.gentoo.org/glsa/201507-05 - http://www.ubuntu.com/usn/USN-2698-1 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://www.sqlite.org/src/info/c494171f77dc2e5e04cb6d865e688448f04e5920 - https://support.apple.com/HT205267 - http://lists.apple.com/archives/security-
494171f77dc2e5e04cb6d865e688448f04e5920 - https://support.apple.com/HT205267 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:217 - https://support.apple.com/HT205213 - http://www.debian.org/security/2015/dsa-3252 - http://seclists.org/fulldisclosure/2015/Apr/31
CVE ID: CVE-2015-3417 State: PUBLISHED Published: 2015-04-24T17:00:00 Last Updated: 2024-08-06T05:47:57.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data. Additional Analyst Notes: - CVE Program Container: References: - https://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4 - https://security.gentoo.org/glsa/201705-08 - http://www.securitytracker.co
3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4 - https://security.gentoo.org/glsa/201705-08 - http://www.securitytracker.com/id/1032198 - http://www.debian.org/security/2015/dsa-3288 - http://www.securityfocus.com/bid/74385 - https://github.com/FFmpeg/FFmpeg/commit/e8714f6f93d1a32f4e4655209960afcf4c185214 - http://seclists.org/fulldisclosure/2015/Apr/31
CVE ID: CVE-2015-3418 State: PUBLISHED Published: 2016-12-13T16:00:00 Last Updated: 2024-08-06T05:47:57.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74328 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b - https://security.gentoo.org/glsa/201701-64 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-251195
- https://security.gentoo.org/glsa/201701-64 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://lists.x.org/archives/xorg-announce/2015-February/002532.html
CVE ID: CVE-2015-3419 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T05:47:57.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure. Additional Analyst Notes: - CVE Program Container: References: - http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4319488-security-patch-released-for-vbulletin-5-1-4-5-1-6-and-vbulletin-cloud - http://www.openwall.com/lists/oss-security/2015/04/24/4
CVE ID: CVE-2015-3420 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T05:47:57.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/28/4 - https://dovecot.org/pipermail/dovecot/2015-April/100618.html - https://dovecot.org/pipermail/dovecot-news/2015-May/000292.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158261.html -
ail/dovecot-news/2015-May/000292.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158261.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157030.html - https://bugzilla.redhat.com/show_bug.cgi?id=1216057 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158236.html - http://www.openwall.com/lists/oss-security/2015/04/27/1 - http://www.securityfocus.com/bid/74335
CVE ID: CVE-2015-3421 State: PUBLISHED Published: 2017-07-21T14:00:00 Last Updated: 2024-08-06T05:47:57.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23255 - http://www.securityfocus.com/bid/74477
CVE ID: CVE-2015-3422 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T05:47:57.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535780/100/0/threaded - http://www.securityfocus.com/bid/75263 - http://packetstormsecurity.com/files/132341/SearchBlox-8.2-Cross-Site-Scripting.html - https://www.htbridge.com/advisory/HTB23256
CVE ID: CVE-2015-3423 State: PUBLISHED Published: 2020-02-08T17:34:26 Last Updated: 2024-08-06T05:47:57.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) ctrl, (2) h____%2427, (3) h____%2439, (4) param0, (5) param1, (6) param2, (7) param3, (8) param4, (9) filter_INSERT_COUNT, (10) filter_MINOR_FALLOUT, (11) filter_UPDATE_COUNT, (12) sort, or (13) sessid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132808/NetCracker-Resource-Management-System-8.
VE Program Container: References: - http://packetstormsecurity.com/files/132808/NetCracker-Resource-Management-System-8.0-SQL-Injection.html - http://www.securityfocus.com/archive/1/archive/1/536054/100/0/threaded
CVE ID: CVE-2015-3424 State: PUBLISHED Published: 2019-12-09T19:13:06 Last Updated: 2024-08-06T05:47:57.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute arbitrary SQL commands via the SIDX parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134176/Accentis-Content-Resource-Management-System-SQL-Injection.html
CVE ID: CVE-2015-3425 State: PUBLISHED Published: 2019-12-09T19:07:59 Last Updated: 2024-08-06T05:47:57.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134177/Accentis-Content-Resource-Management-System-Cross-Site-Scripting.html
CVE ID: CVE-2015-3427 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T05:47:57.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422. Additional Analyst Notes: - CVE Program Container: References: - http://www.quassel-irc.org/node/127 - http://www.debian.org/security/2015/dsa-3258 - http://www.securityfocus.com/bid/74339
CVE ID: CVE-2015-3429 State: PUBLISHED Published: 2015-06-17T18:00:00 Last Updated: 2024-08-06T05:47:57.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier. Additional Analyst Notes: - CVE Program Container: References: - https://www.digitalocean.com/community/tutorials/how-to-protect-your-wordpress-site-from-the-genericons-example-html-xss-vulnerability - https://wpvulndb.com/vulnerabilities/7965 - http://www.securityfocus.com/archive/1/535486/100/1000/threaded - http://www
https://wpvulndb.com/vulnerabilities/7965 - http://www.securityfocus.com/archive/1/535486/100/1000/threaded - http://www.debian.org/security/2015/dsa-3328 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html - https://github.com/Automattic/Genericons/commit/798ac98579dd72dfdb11bdee3e7bebf01cffb1f7 - https://wordpress.org/news/2015/05/wordpress-4-2-2/ - https://www.netsparker.com/cve-2015-3429-dom-xss-vulnerability-in-twenty-fifteen-wordpress-theme/ - http://seclists.org/fulldisclosure/2015/May/41 - http://www.securityfocus.com/bid/74534 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html - http://packetstormsecurity.com/files/131802/Wo
lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html - http://packetstormsecurity.com/files/131802/WordPress-Twenty-Fifteen-4.2.1-Cross-Site-Scripting.html
CVE ID: CVE-2015-3431 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T05:47:57.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities." Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/en/community/releases/pydio-core/pydio-607-security-release - http://www.securityfocus.com/bid/74596
CVE ID: CVE-2015-3432 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T05:47:57.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities." Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/en/community/releases/pydio-core/pydio-607-security-release - http://www.securityfocus.com/bid/74596
CVE ID: CVE-2015-3435 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:47:57.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-157/ - http://www.securityfocus.com/bid/74400 - http://www.zerodayinitiative.com/advisories/ZDI-15-156/
CVE ID: CVE-2015-3436 State: PUBLISHED Published: 2015-06-09T14:00:00 Last Updated: 2024-08-06T05:47:57.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html - http://www.securityfocus.com/bid/75104 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html - https://jira.zarafa.com/browse/ZCP-13282
CVE ID: CVE-2015-3438 State: PUBLISHED Published: 2015-08-05T01:00:00 Last Updated: 2024-08-06T05:47:57.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html - https://wpvulndb.com/vulnerabilities/7929 - https://wordpr
project.org/pipermail/package-announce/2015-May/157391.html - https://wpvulndb.com/vulnerabilities/7929 - https://wordpress.org/news/2015/04/wordpress-4-1-2/ - http://www.securityfocus.com/bid/74269 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html - http://www.securitytracker.com/id/1032207 - http://www.debian.org/security/2015/dsa-3250 - http://codex.wordpress.org/Version_4.1.2 - https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html