Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3947 State: PUBLISHED Published: 2016-01-15T02:00:00 Last Updated: 2024-08-06T06:04:02.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE ID: CVE-2015-3948 State: PUBLISHED Published: 2016-01-15T02:00:00 Last Updated: 2024-08-06T06:04:00.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE ID: CVE-2015-3949 State: PUBLISHED Published: 2015-06-13T18:00:00 Last Updated: 2024-08-06T06:04:00.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75100 - https://ics-cert.us-cert.gov/advisories/ICSA-15-160-02
CVE ID: CVE-2015-3950 State: PUBLISHED Published: 2015-06-05T10:00:00 Last Updated: 2024-08-06T06:04:01.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-155-01 - http://www.securityfocus.com/bid/75032
CVE ID: CVE-2015-3951 State: PUBLISHED Published: 2015-06-13T18:00:00 Last Updated: 2024-08-06T06:04:01.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: RLE Nova-Wind Turbine HMI devices store cleartext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75163 - https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01
CVE ID: CVE-2015-3952 State: PUBLISHED Published: 2019-03-25T15:42:39 Last Updated: 2024-08-06T06:04:01.121Z Vendors: Hospira Products: Plum A+ Infusion System, Plum A+3 Infusion System, Symbiq Infusion System Problem Types: CWE-312 Description: Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: -
Infusion System which is not vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01
CVE ID: CVE-2015-3953 State: PUBLISHED Published: 2019-03-25T16:02:25 Last Updated: 2024-08-06T06:04:00.957Z Vendors: Hospira Products: Plum A+ Infusion System, Plum A+3 Infusion System, Symbiq Infusion System Problem Types: CWE-259 Description: Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: -
CVE ID: CVE-2015-3954 State: PUBLISHED Published: 2019-03-25T16:12:01 Last Updated: 2024-08-06T06:04:01.128Z Vendors: Hospira Products: Plum A+ Infusion System, Plum A+3 Infusion System, Symbiq Infusion System Problem Types: CWE-285 Description: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior give unauthenticated users root privileges on Port 23/TELNET by default. An unauthorized user could issue commands to the pump. Hospira recommends that customers close Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this iss
LNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01
CVE ID: CVE-2015-3955 State: PUBLISHED Published: 2015-07-06T19:10:00 Last Updated: 2024-08-06T06:04:01.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm - http://www.securityfocus.com/bid/75132 - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01B
CVE ID: CVE-2015-3956 State: PUBLISHED Published: 2019-03-25T17:44:44 Last Updated: 2024-08-06T06:04:02.927Z Vendors: Hospira Products: Plum A+ Infusion System, Plum A+3 Infusion System, Symbiq Infusion System Problem Types: CWE-345 Description: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System wh
close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01
CVE ID: CVE-2015-3957 State: PUBLISHED Published: 2015-07-06T19:10:00 Last Updated: 2024-08-06T06:04:01.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm - http://www.securityfocus.com/bid/75136 - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01B
CVE ID: CVE-2015-3958 State: PUBLISHED Published: 2015-07-06T19:10:00 Last Updated: 2024-08-06T06:04:01.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm - http://www.securityfocus.com/bid/75138 - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01B
CVE ID: CVE-2015-3959 State: PUBLISHED Published: 2015-08-04T01:00:00 Last Updated: 2024-08-06T06:04:01.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75235 - http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pd
References: - http://www.securityfocus.com/bid/75235 - http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE ID: CVE-2015-3960 State: PUBLISHED Published: 2015-08-04T01:00:00 Last Updated: 2024-08-06T06:04:01.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75236 - http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf - h
ences: - http://www.securityfocus.com/bid/75236 - http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE ID: CVE-2015-3961 State: PUBLISHED Published: 2015-08-04T01:00:00 Last Updated: 2024-08-06T06:04:01.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75228 - http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE ID: CVE-2015-3962 State: PUBLISHED Published: 2015-09-18T22:00:00 Last Updated: 2024-08-06T06:04:01.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01
CVE ID: CVE-2015-3963 State: PUBLISHED Published: 2015-08-04T01:00:00 Last Updated: 2024-08-06T06:04:01.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75302 - http://www.securitytracker.com/id/1032
: - CVE Program Container: References: - http://www.securityfocus.com/bid/75302 - http://www.securitytracker.com/id/1032730 - http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A - http://www.securitytracker.com/id/1033181 - https://security.netapp.com/advisory/ntap-20160324-0001/ - https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01
CVE ID: CVE-2015-3964 State: PUBLISHED Published: 2015-09-11T16:00:00 Last Updated: 2024-08-06T06:04:01.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Sep/51 - https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02
CVE ID: CVE-2015-3965 State: PUBLISHED Published: 2019-03-23T19:23:49 Last Updated: 2024-08-06T06:04:02.807Z Vendors: Hospira Products: Symbiq Infusion System Problem Types: Other Description: Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01
CVE ID: CVE-2015-3966 State: PUBLISHED Published: 2015-08-30T14:00:00 Last Updated: 2024-08-06T06:04:02.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression. Additional Analyst Notes: - CVE Program Container: References: - http://www.innominate.com/data/downloads/software/innominate_security_advisory_20150714_001_en.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03
CVE ID: CVE-2015-3967 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:01.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3968 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:02.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP port 21. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3969 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:01.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3970 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:02.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3971 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:02.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrary JASIC code, via a session on TCP port 1239. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3972 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:02.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3973 State: PUBLISHED Published: 2015-10-28T10:00:00 Last Updated: 2024-08-06T06:04:02.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations on session-token values. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE ID: CVE-2015-3974 State: PUBLISHED Published: 2015-09-28T01:00:00 Last Updated: 2024-08-06T06:04:02.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a hardcoded password, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-237-02
CVE ID: CVE-2015-3975 State: REJECTED Published: 2017-03-16T15:00:00 Last Updated: 2017-03-16T14:57:01 Description: No description available.
CVE ID: CVE-2015-3976 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2025-11-04T23:33:49.742Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:C/A:N) Vendors: GE Products: Multilink ML800/1200/1600/2400, ML810/3000/3100 series switch Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a - http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_fil
/www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json
CVE ID: CVE-2015-3977 State: PUBLISHED Published: 2015-11-15T02:00:00 Last Updated: 2024-08-06T06:04:02.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-215-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01
CVE ID: CVE-2015-3978 State: PUBLISHED Published: 2015-05-12T20:00:00 Last Updated: 2024-08-06T06:04:02.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830. Additional Analyst Notes: - CVE Program Container: References: - http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/ - https://erpscan.io/press-center/blog/sap-security-notes-april-2015/ - http://www.securitytracker.com/id/1032310 - http://www.securityfocus.com/bid/74625
CVE ID: CVE-2015-3979 State: PUBLISHED Published: 2015-05-12T20:00:00 Last Updated: 2024-08-06T06:04:02.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534. Additional Analyst Notes: - CVE Program Container: References: - http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/ - http://www.securityfocus.com/bid/74626 - http://www.securitytracker.com/id/1032309
CVE ID: CVE-2015-3980 State: PUBLISHED Published: 2015-05-12T20:00:00 Last Updated: 2024-08-06T06:04:02.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534. Additional Analyst Notes: - CVE Program Container: References: - http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/ - http://www.securityfocus.com/bid/74624 - http://www.securitytracker.com/id/1032309
CVE ID: CVE-2015-3981 State: PUBLISHED Published: 2015-05-12T20:00:00 Last Updated: 2024-08-06T06:04:02.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74627 - https://erpscan.io/press-center/blog/sap-security-notes-april-2015/ - http://www.securitytracker.com/id/1032308
CVE ID: CVE-2015-3982 State: PUBLISHED Published: 2015-06-02T14:00:00 Last Updated: 2024-08-06T06:04:02.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. Additional Analyst Notes: - CVE Program Container: References: - https://www.djangoproject.com/weblog/2015/may/20/security-release/ - http://www.securityfocus.com/bid/74960
CVE ID: CVE-2015-3983 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T06:04:02.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0990.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html - https://bugz
ata/RHSA-2015-0990.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html - https://bugzilla.redhat.com/attachment.cgi?id=1009855 - http://rhn.redhat.com/errata/RHSA-2015-0980.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html - http://www.securityfocus.com/bid/74682
CVE ID: CVE-2015-3986 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T06:04:02.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23254 - https://wordpress.org/plugin
Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23254 - https://wordpress.org/plugins/thecartpress/changelog/ - http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://www.securityfocus.com/bid/74395 - https://www.exploit-db.com/exploits/36860/ - http://www.securityfocus.com/archive/1/535396/100/0/threaded