Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
dio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html - http://osvdb.org/show/osvdb/118511 - http://www.securityfocus.com/bid/74851 - http://www.exploit-db.com/exploits/36086 - http://osvdb.org/show/osvdb/118510 - http://www.wonderplugin.com/wordpress-audio-player/
CVE ID: CVE-2015-2219 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:15.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74649 - http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf - http://support.lenovo.com/us/en/product_security/lsu_privilege -
ovo_System_Update_Multiple_Privilege_Escalations.pdf - http://support.lenovo.com/us/en/product_security/lsu_privilege - http://securitytracker.com/id/1032268
CVE ID: CVE-2015-2220 State: PUBLISHED Published: 2015-03-05T16:00:00 Last Updated: 2024-08-06T05:10:14.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74857 - http://www.securityfocus.com/archive
es: - CVE Program Container: References: - http://www.securityfocus.com/bid/74857 - http://www.securityfocus.com/archive/1/534687/100/0/threaded - https://wordpress.org/plugins/ninja-forms/changelog/ - http://packetstormsecurity.com/files/130369/WordPress-Ninja-Forms-2.8.8-Cross-Site-Scripting.html
CVE ID: CVE-2015-2221 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:15.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2594-1 - https://security.gentoo.org/glsa/201512-08 - http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html - http://www.securityfocus.com/bid/74443 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html
CVE ID: CVE-2015-2222 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:15.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2594-1 - https://security.gentoo.org/glsa/201512-08 - http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html - http://www.securityfocus.com/bid/74443 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html
CVE ID: CVE-2015-2223 State: PUBLISHED Published: 2015-04-14T14:00:00 Last Updated: 2024-08-06T05:10:16.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535113/100/0/threaded - http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-S
ive/1/535113/100/0/threaded - http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/73704 - https://security.paloaltonetworks.com/CVE-2015-2223
CVE ID: CVE-2015-2230 State: PUBLISHED Published: 2019-05-30T19:46:49 Last Updated: 2024-08-06T05:10:15.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Security_Center - https://bugzilla.zimbra.com/show_bug.cgi?id=97625
CVE ID: CVE-2015-2233 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:15.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf - http://support.lenovo.com/us/en/product_security/lsu_privilege - http://securitytracker.com/id/1032268 - http://www.securityfocus.co
rt.lenovo.com/us/en/product_security/lsu_privilege - http://securitytracker.com/id/1032268 - http://www.securityfocus.com/bid/74642
CVE ID: CVE-2015-2234 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:10:15.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated. Additional Analyst Notes: - CVE Program Container: References: - http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf - http://support.lenovo.com/us/en/product_security/lsu_privilege - http://www.securityfocus.com/bid/74634 - http://se
df - http://support.lenovo.com/us/en/product_security/lsu_privilege - http://www.securityfocus.com/bid/74634 - http://securitytracker.com/id/1032268
CVE ID: CVE-2015-2235 State: REJECTED Published: 2015-03-07T02:00:00 Last Updated: 2015-03-11T00:57:00 Description: No description available.
CVE ID: CVE-2015-2236 State: REJECTED Published: 2022-07-08T17:36:14 Last Updated: 2022-07-08T17:36:14 Description: No description available.
CVE ID: CVE-2015-2237 State: PUBLISHED Published: 2015-03-12T17:00:00 Last Updated: 2024-08-06T05:10:15.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36306/ - http://www.securityfocus.com/archive/1/534816/100/0/threaded - http://packetstormsecurity.com/files/130696/Betster-1.0.4-SQL-Injection-Authentication-Bypass.html
CVE ID: CVE-2015-2238 State: PUBLISHED Published: 2015-03-09T00:00:00 Last Updated: 2024-08-06T05:10:15.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2521-1 - http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html
CVE ID: CVE-2015-2239 State: PUBLISHED Published: 2015-03-09T00:00:00 Last Updated: 2024-08-06T05:10:15.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74855 - h
E-2015-1231. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74855 - http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html - https://code.google.com/p/chromium/issues/detail?id=256724 - https://code.google.com/p/chromium/issues/detail?id=463349
CVE ID: CVE-2015-2241 State: PUBLISHED Published: 2015-03-12T14:00:00 Last Updated: 2024-08-06T05:10:15.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73095 - https://code.djangoproject.com/ticket/24461 - https://www.djangoproject.com/weblog/2015/mar/09/security-releases/ - http://www.mandriva.com/security
om/ticket/24461 - https://www.djangoproject.com/weblog/2015/mar/09/security-releases/ - http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
CVE ID: CVE-2015-2242 State: PUBLISHED Published: 2015-03-09T17:00:00Z Last Updated: 2024-09-17T02:52:30.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130656/Webshop-Hun-1.062S-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Mar/27 - http://tetraph.com/security/sql-injection-vulnerability/webshop-hun-v1-062s-sql-injection-security-vulnerabilities/
CVE ID: CVE-2015-2243 State: PUBLISHED Published: 2015-03-09T17:00:00Z Last Updated: 2024-09-16T17:43:53.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130653/Webshop-Hun-1.062S-Directory-Traversal.html - http://tetraph.com/security/directory-traversal-vulnerability/webshop-hun-v1-062s-directory-traversal-security-vulnerabilities/ - http://seclists.org/fulldisclosure/2015/Mar/26
CVE ID: CVE-2015-2244 State: PUBLISHED Published: 2015-03-09T17:00:00Z Last Updated: 2024-09-16T20:53:15.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://tetraph.com/security/xss-vulnerability/webshop-hun-v1-062s-xss-cross-site-scripting-security-vulnerabilities/ - http://packetstormsecurity.com/files/130648/Webshop-Hun-1.062S-Cross-Site-Scripting.html - http://seclists.org/fulldisc
http://packetstormsecurity.com/files/130648/Webshop-Hun-1.062S-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2015/Mar/25
CVE ID: CVE-2015-2245 State: PUBLISHED Published: 2017-06-27T20:00:00 Last Updated: 2024-08-06T05:10:15.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72571 - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-414153.htm
CVE ID: CVE-2015-2246 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-06T05:10:15.952Z Vendors: n/a Products: P7-L10 V100R001C00B136 and earlier versions Problem Types: Information Leakage Description: The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/hw-414289
CVE ID: CVE-2015-2247 State: PUBLISHED Published: 2015-04-10T17:00:00 Last Updated: 2024-08-06T05:10:15.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal. Additional Analyst Notes: - CVE Program Container: References: - https://speakerdeck.com/richo/building-a-hipster-catapult-or-how2own-your-skateboard - https://twitter.com/rich0H/status/576484574504439808 - http://www.theregister.co.uk/2014/12/19/hack_hijacks_boosted_skate
ttps://twitter.com/rich0H/status/576484574504439808 - http://www.theregister.co.uk/2014/12/19/hack_hijacks_boosted_skateboards_kills_hipsters/ - https://twitter.com/aphyr/status/576502129264738304
CVE ID: CVE-2015-2248 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:10:16.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032227 - http://www.securityfocus.com/bid/73098 - http://packetstormsecurity.com/files/131762/Dell-SonicW
racker.com/id/1032227 - http://www.securityfocus.com/bid/73098 - http://packetstormsecurity.com/files/131762/Dell-SonicWALL-Secure-Remote-Access-7.5-8.0-CSRF.html - http://www.scip.ch/en/?vuldb.75111 - https://www.exploit-db.com/exploits/36940/ - https://support.software.dell.com/product-notification/151370?productName=SonicWALL%20SRA%20Series
CVE ID: CVE-2015-2249 State: PUBLISHED Published: 2020-01-27T18:28:22 Last Updated: 2024-08-06T05:10:15.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration before 8.6.0 patch5 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE ID: CVE-2015-2250 State: PUBLISHED Published: 2015-05-15T18:00:00 Last Updated: 2024-08-06T05:10:15.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to index.php/dashboard/reports/logs/view, (3) accessType parameter to index.php/tools/required/permissions/access_entity, (4) msCountry parameter to index.php/dashboard/system/multilingual/setup/load_icon, arHandle parameter to (5) design/submit or (6) design in index.
index.php/dashboard/system/multilingual/setup/load_icon, arHandle parameter to (5) design/submit or (6) design in index.php/ccm/system/dialogs/area/design/submit, (7) pageURL to index.php/dashboard/pages/single, (8) SEARCH_INDEX_AREA_METHOD parameter to index.php/dashboard/system/seo/searchindex/updated, (9) unit parameter to index.php/dashboard/system/optimization/jobs/job_scheduled, (10) register_notification_email parameter to index.php/dashboard/system/registration/open/1, or (11) PATH_INFO to index.php/dashboard/extend/connect/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131882/Concrete5-5.7.3.1-Cross-Site-Scripting.html - http:
Container: References: - http://packetstormsecurity.com/files/131882/Concrete5-5.7.3.1-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/74651 - https://www.netsparker.com/cve-2015-2250-multiple-xss-vulnerabilities-identified-in-concrete5/ - http://seclists.org/fulldisclosure/2015/May/51 - http://www.securityfocus.com/archive/1/535531/100/0/threaded - https://www.concrete5.org/documentation/developers/5.7/background/version-history/5-7-4-release-notes/
CVE ID: CVE-2015-2251 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T05:10:15.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm
CVE ID: CVE-2015-2252 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T05:10:15.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm
CVE ID: CVE-2015-2253 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T05:10:16.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm
CVE ID: CVE-2015-2254 State: PUBLISHED Published: 2019-03-13T16:00:00 Last Updated: 2024-08-06T05:10:15.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/hw-417839
CVE ID: CVE-2015-2255 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-06T05:10:15.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417840.htm
CVE ID: CVE-2015-2263 State: PUBLISHED Published: 2017-03-23T20:00:00 Last Updated: 2024-08-06T05:10:15.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topi
am Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_3
CVE ID: CVE-2015-2264 State: PUBLISHED Published: 2015-03-13T01:00:00 Last Updated: 2024-08-06T05:10:15.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/794095
CVE ID: CVE-2015-2265 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T05:10:15.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.linuxfoundation.org/show_bug.cgi?id=1265 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:196 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cup
://www.mandriva.com/security/advisories?name=MDVSA-2015:196 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7333 - http://www.ubuntu.com/usn/USN-2532-1 - http://advisories.mageia.org/MGASA-2015-0132.html - http://lists.opensuse.org/opensuse-updates/2015-07/msg00033.html
CVE ID: CVE-2015-2266 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49204 - https://moodle.org/mod/forum/discuss.php?d=307
://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49204 - https://moodle.org/mod/forum/discuss.php?d=307380 - http://openwall.com/lists/oss-security/2015/03/16/1
CVE ID: CVE-2015-2267 State: PUBLISHED Published: 2015-06-01T19:00:00 Last Updated: 2024-08-06T05:10:15.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087 - https://moodle.org/mod/forum/discuss.php?d=307381 - http://openwall.com/lists/oss-security/2015/03/16/1