Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7558 State: PUBLISHED Published: 2016-05-20T14:00:00 Last Updated: 2024-08-06T07:51:28.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/12/21/5 - https://git.gnome.org/browse/librsvg/commit/?id=a51919f7e1ca9c535390a746fbf6e28c8402dc61 - http://www.openwall.com/lists/oss-security/2016/04/30/3 - http://www.debian.org/security/2016/dsa-3584 - https://bugzilla.redhat.co
openwall.com/lists/oss-security/2016/04/30/3 - http://www.debian.org/security/2016/dsa-3584 - https://bugzilla.redhat.com/show_bug.cgi?id=1268243
CVE ID: CVE-2015-7559 State: PUBLISHED Published: 2019-08-01T00:00:00 Last Updated: 2024-08-06T07:51:28.509Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Apache Products: ActiveMQ Problem Types: CWE-306 Description: It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559 - https://issues.apache.org/jira/browse/AMQ-6470
CVE ID: CVE-2015-7560 State: PUBLISHED Published: 2016-03-13T22:00:00 Last Updated: 2024-08-06T07:51:28.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/84267 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - http://lists.opensuse.org/opensuse-security-
ttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842 - http://www.securitytracker.com/id/1035220 - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html - https://www.samba.org/samba/security/CVE-2015-7560.html - https://bugzilla.samba.org/show_bug.cgi?
16-03/msg00064.html - https://www.samba.org/samba/security/CVE-2015-7560.html - https://bugzilla.samba.org/show_bug.cgi?id=11648 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html - http://www.ubuntu.com/usn/USN-2922-1 - http://www.debian.org/security/2016/dsa-3514
CVE ID: CVE-2015-7561 State: PUBLISHED Published: 2017-08-07T17:00:00 Last Updated: 2024-08-06T07:51:28.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/pull/18909 - https://bugzilla.redhat.com/show_bug.cgi?id=1291963
CVE ID: CVE-2015-7562 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-06T07:51:28.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39559/ - https://github.com/nilsteampassnet/TeamPass/pull/1140
CVE ID: CVE-2015-7563 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-06T07:51:28.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39559/ - https://github.com/nilsteampassnet/TeamPass/pull/1140
CVE ID: CVE-2015-7564 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-06T07:51:28.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39559/ - https://github.com/nilsteampassnet/TeamPass/pull/1140
CVE ID: CVE-2015-7565 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T07:51:28.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - http://emberjs.com/blog/2016/01/14/security-releases-ember-1-11-4-1-12-2-1-13-12-2-0-3-2-1-2-2-2-1.html - https://groups.google.com/forum/#%21topic/ember-security/OfyQkoSuppY
CVE ID: CVE-2015-7566 State: PUBLISHED Published: 2016-02-08T02:00:00 Last Updated: 2024-08-06T07:51:28.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2930-1 - https://security-tracker.debian.org/tracker/CVE-2015-7566 - http://www.securityfocus.com/bid/82975 - http://www.ubuntu.com/usn
//security-tracker.debian.org/tracker/CVE-2015-7566 - http://www.securityfocus.com/bid/82975 - http://www.ubuntu.com/usn/USN-2967-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175792.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c - http://www.ubuntu.com/usn/USN-2930-2 - https://bugzilla.redhat.com/show_bug.cgi?id=1283371 - http://www.debian.org/security/2016/dsa-3503 - http://www.ubuntu.com/usn/USN-2967-2 - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176194.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - http://www.ubuntu.com/u
nuary/176194.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - http://www.ubuntu.com/usn/USN-2930-3 - https://bugzilla.redhat.com/show_bug.cgi?id=1296466 - http://www.securityfocus.com/archive/1/537733/100/0/threaded - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html - http://www.ubuntu.com/usn/USN-2929-1 - http://www.ubuntu.com/usn/USN-2932-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://www.ubuntu.com/usn/USN-2948-1 - http://www.de
sts.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://www.ubuntu.com/usn/USN-2948-1 - http://www.debian.org/security/2016/dsa-3448 - http://www.ubuntu.com/usn/USN-2929-2 - https://www.exploit-db.com/exploits/39540/ - http://www.ubuntu.com/usn/USN-2948-2 - https://github.com/torvalds/linux/commit/cb3232138e37129e88240a98a1d2aba2187ff57c
CVE ID: CVE-2015-7567 State: PUBLISHED Published: 2020-02-18T17:41:12 Last Updated: 2024-08-06T07:51:28.460Z Vendors: n/a Products: Yeager CMS Problem Types: SQL Injection Description: SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html - http://www.securityfocus.com/archive/1/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://seclists.org/fulldisclosure/2016/Feb/44
CVE ID: CVE-2015-7568 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:51:28.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html - http://seclists.org/fulldisclosure/2016/Feb/44
CVE ID: CVE-2015-7569 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:51:28.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html - http://seclists.org/fulldisclosure/2016/Feb/44
CVE ID: CVE-2015-7570 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:51:28.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php, libs/org/adodb_lite/tests/test_datadictionary.php, or libs/org/adodb_lite/tests/test_adodb_lite_sessions.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://packetstor
//www.securityfocus.com/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html - http://seclists.org/fulldisclosure/2016/Feb/44
CVE ID: CVE-2015-7571 State: PUBLISHED Published: 2017-08-07T20:00:00 Last Updated: 2024-08-06T07:51:28.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537493/100/0/threaded - https://www.exploit-db.com/exploits/39436/ - http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html - http://seclists.org/fulldisclosure/2016/Feb/44
CVE ID: CVE-2015-7572 State: REJECTED Published: 2017-04-24T18:00:00 Last Updated: 2017-04-24T17:57:01 Description: No description available.
CVE ID: CVE-2015-7573 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-7574 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-7575 State: PUBLISHED Published: 2016-01-09T02:00:00 Last Updated: 2024-08-06T07:51:28.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3688 - http://www.debian.org/security/2016/dsa-3457 - http://www.debian.org/security/2016/dsa-3
an.org/security/2016/dsa-3688 - http://www.debian.org/security/2016/dsa-3457 - http://www.debian.org/security/2016/dsa-3491 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html - http://www.securitytracker.com/id/1036467 - https://security.gentoo.org/glsa/201701-46 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html - http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://www.ubuntu.com/usn/USN-2884-1 - http://www.securityfocus.com/bid/79684 - http://www.debian.org/security/2016/dsa-3465 - https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS
m/bid/79684 - http://www.debian.org/security/2016/dsa-3465 - https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - https://access.redhat.com/errata/RHSA-2016:1430 - https://bugzilla.mozilla.org/show_bug.cgi?id=1158489 - http://rhn.redhat.com/errata/RHSA-2016-0049.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html - http://www.debia
ity-announce/2016-01/msg00045.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html - http://www.debian.org/security/2016/dsa-3437 - http://rhn.redhat.com/errata/RHSA-2016-0053.html - http://www.ubuntu.com/usn/USN-2904-1 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html - https://security.netapp.com/advisory/ntap-20160225-0001/ - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html - http://www.debian.org/security/2016/dsa-3436 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html - http://www.ubuntu.com/usn/USN-2866-1 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html - http://www.oracl
buntu.com/usn/USN-2866-1 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html - http://www.securityfocus.com/bid/91787 - http://www.mozilla.org/security/announce/2015/mfsa2015-150.html - http://rhn.redhat.com/errata/RHSA-2016-0055.html - https://security.gentoo.org/glsa/201801-15 - http://rhn.redhat.com/errata/RHSA-2016-0054.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html - https://security.gentoo.org/glsa/201706-18 - http://www.ubuntu.com/usn/USN-2864-1 - http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html - http://lists.opensuse.org/opensuse-updates/2
2864-1 - http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html - http://rhn.redhat.com/errata/RHSA-2016-0056.html - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html - http://rhn.redhat.com/errata/RHSA-2016-0050.html - http://www.debian.org/security/2016/dsa-3458 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html - http://www.ubuntu.com/usn/USN-2865-1 - http://www.securitytracker.com/id/1034541 - http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html - http://www.ubuntu.com/usn/USN-2863-1
CVE ID: CVE-2015-7576 State: PUBLISHED Published: 2016-02-16T02:00:00 Last Updated: 2024-08-06T07:51:28.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences. Additional Analyst Notes: - CVE Program Container: References: - http://www.op
tication by measuring timing differences. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/01/25/8 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html - http://www.securityfocus.com/bid/81803 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - http://www.securitytracke
ary/178067.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - http://www.securitytracker.com/id/1034816 - http://www.debian.org/security/2016/dsa-3464 - http://rhn.redhat.com/errata/RHSA-2016-0296.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
CVE ID: CVE-2015-7577 State: PUBLISHED Published: 2016-02-16T02:00:00 Last Updated: 2024-08-06T07:51:28.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html - http://lists.opensuse.
ogram Container: References: - http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/cawsWcQ6c8g/LATIsglZEgAJ - http://www.securitytracker.com/id/1034816 - http://www.securityfocus.com/bid/81806 - http://www.debian.org/security/2016/dsa-3464 - http://rhn.redhat.com/errata/RHSA-2016-0296.html - http://www
bid/81806 - http://www.debian.org/security/2016/dsa-3464 - http://rhn.redhat.com/errata/RHSA-2016-0296.html - http://www.openwall.com/lists/oss-security/2016/01/25/10
CVE ID: CVE-2015-7578 State: PUBLISHED Published: 2016-02-16T02:00:00 Last Updated: 2024-08-06T07:51:28.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178046.html - http://www.openwall.com/lists/oss-security/2016/01/25/11 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - https://github.com/rails/rails-html-
5/11 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - https://github.com/rails/rails-html-sanitizer/commit/297161e29a3e11186ce4c02bf7defc088bf544d4 - http://www.securitytracker.com/id/1034816 - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/uh--W4TDwmI/ygHE7hlZEgAJ - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178064.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html
CVE ID: CVE-2015-7579 State: PUBLISHED Published: 2016-02-16T02:00:00 Last Updated: 2024-08-06T07:51:28.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails-html-sanitizer/commit/49dfc1584c5b8e35a4ffabf8356ba3df025e8d3f - https://groups.google.com/forum/message/raw?msg=ruby-security-ann/OU9ugTZcbjc/uksRkSxZEgAJ - http://lists.fedoraprojec
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/OU9ugTZcbjc/uksRkSxZEgAJ - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178046.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - http://www.securitytracker.com/id/1034816 - http://www.openwall.com/lists/oss-security/2016/01/25/12 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178064.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html
CVE ID: CVE-2015-7580 State: PUBLISHED Published: 2016-02-16T02:00:00 Last Updated: 2024-08-06T07:51:28.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/message/raw?msg=rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html - http://www.openwall.com/lists/oss-security/2016/01/25/15
opensuse.org/opensuse-security-announce/2016-04/msg00053.html - http://www.openwall.com/lists/oss-security/2016/01/25/15 - http://www.securitytracker.com/id/1034816 - https://github.com/rails/rails-html-sanitizer/commit/63903b0eaa6d2a4e1c91bc86008256c4c8335e78 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html