Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-0894 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:26:11.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/ - http://jvn.jp/en/jp/JVN30832515/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000037
CVE ID: CVE-2015-0895 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:26:11.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/ - http://jvn.jp/en/jp/JVN87204433/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000038
CVE ID: CVE-2015-0896 State: PUBLISHED Published: 2015-03-18T23:00:00 Last Updated: 2024-08-06T04:26:11.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000039 - http://jvn.jp/en/jp/JVN97099798/index.html - http://extplorer.net/news/16
CVE ID: CVE-2015-0897 State: PUBLISHED Published: 2023-10-31T09:28:50.586Z Last Updated: 2024-09-12T20:00:26.126Z Vendors: LINE Corporation Products: LINE for Android, LINE for iOS Problem Types: Script injection Description: LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://official-blog.line.me/ja/archives/24809761.html - https://jvn.jp/en/jp/JVN41281927/
CVE ID: CVE-2015-0898 State: PUBLISHED Published: 2015-03-21T01:00:00 Last Updated: 2024-08-06T04:26:11.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN39175666/index.html - http://www.futomi.com/library/info/2015/20150319.html - http://jvn.jp/en/jp/JVN39175666/221504/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000041
CVE ID: CVE-2015-0899 State: PUBLISHED Published: 2016-07-04T22:00:00 Last Updated: 2024-08-06T04:26:11.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20180629-0006/ - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042 - http://jvn.jp/en/jp/JVN86448949/index.html - http://www.debian.org/security/2016/dsa-3536 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://en.osdn.jp/pro
ity/2016/dsa-3536 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN - http://www.securityfocus.com/bid/74423
CVE ID: CVE-2015-0900 State: PUBLISHED Published: 2015-03-31T10:00:00 Last Updated: 2024-08-06T04:26:11.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN74547976/995592/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000043 - http://www.nishishi.com/cgi/ftsb/20150321.html - http://jvn.jp/en/jp/JVN74547976/index.html
CVE ID: CVE-2015-0901 State: PUBLISHED Published: 2015-03-31T10:00:00 Last Updated: 2024-08-06T04:26:11.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7872 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000044 - http://jvn.jp/en/jp/JVN97281747/index.html
CVE ID: CVE-2015-0902 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN75615300/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000046 - http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
CVE ID: CVE-2015-0903 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN58784309/294291/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000048 - http://jvn.jp/en/jp/JVN58784309/index.html
CVE ID: CVE-2015-0904 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-06T04:26:11.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000049.html - http://jvn.jp/en/jp/JVN68819526/index.html
CVE ID: CVE-2015-0905 State: PUBLISHED Published: 2015-04-08T01:00:00 Last Updated: 2024-08-06T04:26:11.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/projects/bblog/ - http://www.securitytracker.com/id/1032041 - http://jvn.jp/en/jp/JVN71903938/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000047
CVE ID: CVE-2015-0906 State: PUBLISHED Published: 2015-04-15T10:00:00 Last Updated: 2024-08-06T04:26:11.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN02527990/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000050 - http://www7a.biglobe.ne.jp/~schezo/ - http://jvn.jp/en/jp/JVN02527990/414318/index.html
CVE ID: CVE-2015-0907 State: PUBLISHED Published: 2015-04-15T10:00:00 Last Updated: 2024-08-06T04:26:11.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN12329472/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000051 - http://www7a.biglobe.ne.jp/~schezo/ - http://jvn.jp/en/jp/JVN12329472/414318/index.html
CVE ID: CVE-2015-0910 State: PUBLISHED Published: 2015-04-24T01:00:00 Last Updated: 2024-08-06T04:26:11.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000054 - http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/ - http://jvn.jp/en/jp/JVN26860747/index.html
CVE ID: CVE-2015-0911 State: PUBLISHED Published: 2015-04-24T01:00:00 Last Updated: 2024-08-06T04:26:11.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000055 - http://jvn.jp/en/jp/JVN41653647/index.html - http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/
CVE ID: CVE-2015-0912 State: PUBLISHED Published: 2015-05-01T10:00:00 Last Updated: 2024-08-06T04:26:11.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN67520407/index.html - http://jvn.jp/en/jp/JVN67520407/995657/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000060
CVE ID: CVE-2015-0913 State: PUBLISHED Published: 2015-05-01T10:00:00 Last Updated: 2024-08-06T04:26:11.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN07538357/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000061 - http://jvn.jp/en/jp/JVN07538357/995657/index.html
CVE ID: CVE-2015-0914 State: PUBLISHED Published: 2015-05-01T10:00:00 Last Updated: 2024-08-06T04:26:11.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000062 - http://jvn.jp/en/jp/JVN96439865/index.html - http://jvn.jp/en/jp/JVN96439865/995657/index.html
CVE ID: CVE-2015-0915 State: PUBLISHED Published: 2015-05-22T00:00:00 Last Updated: 2024-08-06T04:26:11.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000063 - http://jvn.jp/en/jp/JVN20133698/index.html - http://support.maildealer.jp/announce/150511.php
CVE ID: CVE-2015-0916 State: PUBLISHED Published: 2015-05-22T00:00:00 Last Updated: 2024-08-06T04:26:11.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. Additional Analyst Notes: - CVE Program Container: References: - http://www.cacti.net/release_notes_0_8_6f.php - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064 - http://jvn.jp/en/jp/JVN18957556/index.html
CVE ID: CVE-2015-0917 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-17T04:25:00.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129826/Kajona-CMS-4.6-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2015/Jan/11 - https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html - http://sroesemann.blogspot.de/2015/
/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-01.html - https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7
CVE ID: CVE-2015-0918 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-16T22:03:19.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/10 - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-06.html - http://packetstormsecurity.com/files/129825/Sefrengo-CMS-1.6.0-Cross-Site-Scripting.html - http://forum.sefrengo.org/index.php?
packetstormsecurity.com/files/129825/Sefrengo-CMS-1.6.0-Cross-Site-Scripting.html - http://forum.sefrengo.org/index.php?showtopic=3360
CVE ID: CVE-2015-0919 State: PUBLISHED Published: 2015-01-08T15:00:00Z Last Updated: 2024-09-17T01:11:11.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/9 - http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html - http://forum.sefrengo.org/index.
html - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html - http://forum.sefrengo.org/index.php?showtopic=3360
CVE ID: CVE-2015-0920 State: PUBLISHED Published: 2015-01-08T15:00:00 Last Updated: 2024-08-06T04:26:11.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99613 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99614 - http://
xchange.xforce.ibmcloud.com/vulnerabilities/99613 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99614 - http://packetstormsecurity.com/files/129804/WordPress-Banner-Effect-Header-1.2.6-XSS-CSRF.html
CVE ID: CVE-2015-0921 State: PUBLISHED Published: 2015-01-09T18:00:00 Last Updated: 2024-08-06T04:26:11.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61922 - http://seclists.org/fulldisclosure/2015/Jan/37 - https://kc.mcafee.com/corporate/index?page=content&id=SB10095 - http://packetstormsecurity.com/files/129827
015/Jan/37 - https://kc.mcafee.com/corporate/index?page=content&id=SB10095 - http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html - http://seclists.org/fulldisclosure/2015/Jan/8 - http://www.securitytracker.com/id/1031519 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99950 - https://gist.github.com/brandonprry/692e553975bf29aeaf2c
CVE ID: CVE-2015-0922 State: PUBLISHED Published: 2015-01-09T18:00:00 Last Updated: 2024-08-06T04:26:11.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72298 - http://seclists.org/fulldisclosure/2015/Jan/37 - https://kc.mcafee.com/corporate/index?page=content&id=SB10095 - http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchest
.mcafee.com/corporate/index?page=content&id=SB10095 - http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html - http://seclists.org/fulldisclosure/2015/Jan/8 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99949 - http://www.securitytracker.com/id/1031519 - https://gist.github.com/brandonprry/692e553975bf29aeaf2c
CVE ID: CVE-2015-0923 State: PUBLISHED Published: 2015-02-14T02:00:00 Last Updated: 2024-08-06T04:26:11.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/377644
CVE ID: CVE-2015-0924 State: PUBLISHED Published: 2015-01-17T11:00:00 Last Updated: 2024-08-06T04:26:11.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a (1) HTTP, (2) SSH, (3) TELNET, or (4) CLI session. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/936356
CVE ID: CVE-2015-0925 State: PUBLISHED Published: 2015-01-22T11:00:00 Last Updated: 2024-08-06T04:26:11.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/110652
CVE ID: CVE-2015-0926 State: PUBLISHED Published: 2015-02-01T02:00:00 Last Updated: 2024-08-06T04:26:11.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/637068
CVE ID: CVE-2015-0928 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:26:11.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). Additional Analyst Notes: - CVE Program Container: References: - https://redmine.openinfosecfoundation.org/issues/1272 - http://www.securityfocus.com/bid/73117
CVE ID: CVE-2015-0929 State: PUBLISHED Published: 2015-02-03T22:00:00 Last Updated: 2024-08-06T04:26:11.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/522460
CVE ID: CVE-2015-0930 State: PUBLISHED Published: 2015-02-03T22:00:00 Last Updated: 2024-08-06T04:26:11.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/522460
CVE ID: CVE-2015-0931 State: PUBLISHED Published: 2015-02-14T02:00:00 Last Updated: 2024-08-06T04:26:11.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/377644
CVE ID: CVE-2015-0932 State: PUBLISHED Published: 2015-04-05T01:00:00 Last Updated: 2024-08-06T04:26:11.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873. Additional Analyst Notes: - CVE Program Container: References: - http://www.wired.com/2015/03/big-vulnerability-hotel-wi-fi-router-puts-guests-risk/ - http://www.kb.cert.org/vuls/id/930956 - http://blog.cylance.com/spear-team-cv
ity-hotel-wi-fi-router-puts-guests-risk/ - http://www.kb.cert.org/vuls/id/930956 - http://blog.cylance.com/spear-team-cve-2015-0932 - http://www.antlabs.com/index.php?option=com_content&view=article&id=195:rsync-remote-file-system-access-vulnerability-cve-2015-0932&catid=54:advisories&Itemid=133
CVE ID: CVE-2015-0933 State: PUBLISHED Published: 2015-03-04T02:00:00 Last Updated: 2024-08-06T04:26:11.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/302668
CVE ID: CVE-2015-0934 State: PUBLISHED Published: 2015-03-04T02:00:00 Last Updated: 2024-08-06T04:26:11.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/302668