Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- http://www.debian.org/security/2015/dsa-3386 - http://www.securitytracker.com/id/1034027 - http://www.ubuntu.com/usn/USN-2788-1 - http://www.openwall.com/lists/oss-security/2015/09/21/6 - http://www.openwall.com/lists/oss-security/2015/09/15/6 - http://www.securityfocus.com/bid/76863 - http://www.openwall.com/lists/oss-security/2015/10/11/5
CVE ID: CVE-2015-7697 State: PUBLISHED Published: 2015-11-06T18:00:00 Last Updated: 2024-08-06T07:58:59.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2788-2 - http://www.openwall.com/lists/oss-security/2015/09/07/4 - http://www.debian.org/security/2015/dsa-3386 - http://www.securitytracker.com/id/1034027 - http://www.ubuntu.com/usn/USN-2788-1 - http://sourceforge.net/p/infozip/patches/23/ - http://www.openwall.com/lists/oss-security/2015/09/15/6 - http://w
88-1 - http://sourceforge.net/p/infozip/patches/23/ - http://www.openwall.com/lists/oss-security/2015/09/15/6 - http://www.securityfocus.com/bid/76863 - http://www.openwall.com/lists/oss-security/2015/10/11/5
CVE ID: CVE-2015-7698 State: PUBLISHED Published: 2015-10-21T18:00:00 Last Updated: 2024-08-06T07:58:59.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2015-017 - https://github.com/icewind1991/SMB/commit/33ab10cc4d5c3e48cba3a074b5f9fc67590cd032
CVE ID: CVE-2015-7699 State: PUBLISHED Published: 2015-10-26T15:00:00 Last Updated: 2024-08-06T07:58:59.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore." Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2015-018 - https://github.com/owncloud/core/pull/18558 - http://www.debian.org/security/2015/dsa-3373
CVE ID: CVE-2015-7700 State: PUBLISHED Published: 2017-08-31T22:00:00 Last Updated: 2024-08-06T07:58:59.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/pmt/news/2015/10/pngcrush-1787-released/ - http://pmt.sourceforge.net/pngcrush/changelog.html
CVE ID: CVE-2015-7701 State: PUBLISHED Published: 2017-08-07T20:00:00 Last Updated: 2024-08-06T07:58:59.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption). Additional Analyst Notes: - CVE Program Container: References: - http://support.ntp.org/bin/view/Main/NtpBug2909 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://rhn.redhat.com/errata/RHSA-2016-2583.html - http://www.securitytracker.com/id/1033951 - http://rhn.redhat.com/errata/RHSA-2016-0780.html - http://w
2016-2583.html - http://www.securitytracker.com/id/1033951 - http://rhn.redhat.com/errata/RHSA-2016-0780.html - http://www.debian.org/security/2015/dsa-3388 - http://www.securityfocus.com/bid/77281 - https://bugzilla.redhat.com/show_bug.cgi?id=1274255 - https://security.gentoo.org/glsa/201607-15 - https://security.netapp.com/advisory/ntap-20171004-0001/
CVE ID: CVE-2015-7702 State: PUBLISHED Published: 2017-08-07T20:00:00 Last Updated: 2024-08-06T07:58:59.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77286 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://support.ntp.org/bin/view/Main/NtpBug2899 - http://rhn.redhat.com/errata/RHSA-2016-2583.html - http://www.secu
l - http://support.ntp.org/bin/view/Main/NtpBug2899 - http://rhn.redhat.com/errata/RHSA-2016-2583.html - http://www.securitytracker.com/id/1033951 - http://rhn.redhat.com/errata/RHSA-2016-0780.html - http://www.debian.org/security/2015/dsa-3388 - https://security.gentoo.org/glsa/201607-15 - https://security.netapp.com/advisory/ntap-20171004-0001/
CVE ID: CVE-2015-7703 State: PUBLISHED Published: 2017-07-24T14:00:00 Last Updated: 2024-08-06T07:59:00.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://rhn.redhat.com/errat
ces: - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://rhn.redhat.com/errata/RHSA-2016-2583.html - http://www.securitytracker.com/id/1033951 - http://www.securityfocus.com/bid/77278 - http://rhn.redhat.com/errata/RHSA-2016-0780.html - http://support.ntp.org/bin/view/Main/NtpBug2902 - http://www.debian.org/security/2015/dsa-3388 - https://bugzilla.redhat.com/show_bug.cgi?id=1254547 - https://security.gentoo.org/glsa/201607-15 - https://security.netapp.com/advisory/ntap-20171004-0001/
CVE ID: CVE-2015-7704 State: PUBLISHED Published: 2017-08-07T20:00:00 Last Updated: 2024-08-06T07:58:59.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1271070 - http://rhn.redhat.com/errata/RHSA-2015-1930.html - http://www.securityfocus.com/bid/77280 - https://www.kb.cert.org/vuls/id/718152 - http://bugs.ntp.org/show_bug.cgi?id=2901 - https://support.citrix.com/article/CTX220112 - http://www.oracle.com/technetwo
ttp://bugs.ntp.org/show_bug.cgi?id=2901 - https://support.citrix.com/article/CTX220112 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://security.netapp.com/advisory/ntap-20171004-0002/ - http://www.securitytracker.com/id/1033951 - http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit - http://www.debian.org/security/2015/dsa-3388 - https://www.cs.bu.edu/~goldbe/NTPattack.html - https://eprint.iacr.org/2015/1020.pdf - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839 - http://rhn.redhat.com/errata/RHSA-2015-2520.html - http://support.ntp.org/bin/view/Main/NtpBug2901 - https://securi
39 - http://rhn.redhat.com/errata/RHSA-2015-2520.html - http://support.ntp.org/bin/view/Main/NtpBug2901 - https://security.gentoo.org/glsa/201607-15 - https://security.netapp.com/advisory/ntap-20171004-0001/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016
CVE ID: CVE-2015-7705 State: PUBLISHED Published: 2017-08-07T20:00:00 Last Updated: 2024-08-06T07:58:59.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html - https://www.kb.cert.org/vuls/id/718152 - http://www.ubuntu.com/usn/USN-2783-1 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html - http://www.securityfocus.com/bid/77284 - https://support.citrix.co
rg/opensuse-security-announce/2016-05/msg00020.html - http://www.securityfocus.com/bid/77284 - https://support.citrix.com/article/CTX220112 - http://www.securitytracker.com/id/1033951 - http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html - https://www.cs.bu.edu/~goldbe/NTPattack.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html - https://eprint.iacr.org/2015/1020.pdf - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839 - https://bugzilla.redhat.com/show_bug.cgi?id=1274184 - http://support.ntp.org/bin/view/Main/NtpB
docId=emr_na-c05270839 - https://bugzilla.redhat.com/show_bug.cgi?id=1274184 - http://support.ntp.org/bin/view/Main/NtpBug2901 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html - https://security.gentoo.org/glsa/201607-15 - https://security.netapp.com/advisory/ntap-20171004-0001/ - http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html - https://bto.bluecoat.com/security-advisory/sa103 - http://list
se.org/opensuse-security-announce/2016-06/msg00001.html - https://bto.bluecoat.com/security-advisory/sa103 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html - http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html - http://www.securityfocus.com/archive/1/536796/100/0/threaded - http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded - http://www.securityfocus.com/archive/1/536737/100/0/threaded - http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded - https://cert-port
e/1/536737/100/0/threaded - http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded - https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11 - https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 - https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016
CVE ID: CVE-2015-7706 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T07:58:59.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to api/v3/public/shares/downloads/, the (2) authType parameter to api/v3/auth/login, or the (3) login parameter to api/v3/auth/reset_password. Additional Analyst Notes: - CVE Program Container: References: - https://kb.ssp-europe.eu/pages/viewpage.action?pageId=12059988 - http://seclists.org/fulldisclosure/2015/Dec/36 - http://www.securityfocus.com/arc
ages/viewpage.action?pageId=12059988 - http://seclists.org/fulldisclosure/2015/Dec/36 - http://www.securityfocus.com/archive/1/537069/100/0/threaded - http://packetstormsecurity.com/files/134760/Secure-Data-Space-3.1.1-2-Cross-Site-Scripting.html
CVE ID: CVE-2015-7707 State: PUBLISHED Published: 2015-10-05T15:00:00 Last Updated: 2024-08-06T07:58:59.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp. Additional Analyst Notes: - CVE Program Container: References: - https://igniterealtime.org/issues/browse/OF-941 - http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt - https://security.gentoo.org/glsa/201612-50 - http://packetstormsecurity.com/files/133559/Openfire-3.10.2-Privilege-Escalation.html - https://www.exploit-db.com/exploits/38190/
CVE ID: CVE-2015-7708 State: PUBLISHED Published: 2015-10-05T15:00:00Z Last Updated: 2024-09-16T21:07:16.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133712/4images-1.7.11-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2015/Sep/95
CVE ID: CVE-2015-7709 State: PUBLISHED Published: 2015-10-05T15:00:00Z Last Updated: 2024-09-17T03:03:30.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation. Additional Analyst Notes: - CVE Program Container: References: - http://www.rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec - https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/37600/
CVE ID: CVE-2015-7711 State: PUBLISHED Published: 2017-08-31T22:00:00 Last Updated: 2024-08-06T07:58:59.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the h parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Nov/12 - http://packetstormsecurity.com/files/134217/ATutor-2.2-Cross-Site-Scripting.html - http://karmainsecurity.com/KIS-2015-07 - http://www.securityfocus.com/archive/1/536837/100/0/threaded
CVE ID: CVE-2015-7712 State: PUBLISHED Published: 2015-11-16T19:00:00 Last Updated: 2024-08-06T07:58:59.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the (1) asc or (2) desc parameter. Additional Analyst Notes: - CVE Program Container: References: - http://karmainsecurity.com/KIS-2015-08 - http://www.securityfocus.com/archive/1/536836/100/0/threaded - http://packetstormsecurity.com/files/134218/ATutor-2.2-PHP-Code-Injection.html - http://seclists.org/fulldisclosure
ed - http://packetstormsecurity.com/files/134218/ATutor-2.2-PHP-Code-Injection.html - http://seclists.org/fulldisclosure/2015/Nov/13
CVE ID: CVE-2015-7713 State: PUBLISHED Published: 2015-10-29T20:00:00 Last Updated: 2024-08-06T07:58:59.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76960 - https://bugs.launchpad.net/nova/+bug/1491307 - https://access.redhat.com/errata/RHSA-2015:2673 - https://bugs.launchpad.net/nova/+bug/1492961 - http://rhn.redhat.com/
https://access.redhat.com/errata/RHSA-2015:2673 - https://bugs.launchpad.net/nova/+bug/1492961 - http://rhn.redhat.com/errata/RHSA-2015-2684.html - https://security.openstack.org/ossa/OSSA-2015-021.html
CVE ID: CVE-2015-7714 State: PUBLISHED Published: 2017-10-18T18:00:00 Last Updated: 2024-08-06T07:58:59.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134066/Realtyna-RPL-8.9.2-SQL-Injection.html - http://www.z
ontainer: References: - http://packetstormsecurity.com/files/134066/Realtyna-RPL-8.9.2-SQL-Injection.html - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php - https://www.exploit-db.com/exploits/38527/ - http://rpl.realtyna.com/change-logs/rpl7-changelog
CVE ID: CVE-2015-7715 State: PUBLISHED Published: 2017-10-18T18:00:00 Last Updated: 2024-08-06T07:58:59.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php - https://www.exploit-db.com/exploits/38528/ - http://rpl.realtyna.com/change-logs/rpl7-changelog - http://packetstormsecurity.com/files/134
t-db.com/exploits/38528/ - http://rpl.realtyna.com/change-logs/rpl7-changelog - http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-Scripting.html
CVE ID: CVE-2015-7716 State: PUBLISHED Published: 2015-10-06T17:00:00 Last Updated: 2024-08-06T07:58:59.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE ID: CVE-2015-7717 State: PUBLISHED Published: 2015-10-06T17:00:00 Last Updated: 2024-08-06T07:58:59.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE ID: CVE-2015-7718 State: PUBLISHED Published: 2015-10-06T17:00:00 Last Updated: 2024-08-06T07:58:59.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE ID: CVE-2015-7723 State: PUBLISHED Published: 2017-06-07T14:00:00 Last Updated: 2024-08-06T07:58:59.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7723/ - http://packetstormsecurity.com/files/134121/AMD-fglrx-driver-14.4.2-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2015/Oct/104 - http://www.securityfocus.com/archive/1/536783/100/0/threaded - http://www.securityfocus.com/bid/77357
CVE ID: CVE-2015-7724 State: PUBLISHED Published: 2017-06-07T14:00:00 Last Updated: 2024-08-06T07:58:59.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134120/AMD-fglrx-driver-15.7-Privilege-Escalation.html - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7724/ - http://www.securityfocus.com/archive/1/536782/100/0/threaded - http://www.securityfocus.com/bid/77361 -
cve-2015-7724/ - http://www.securityfocus.com/archive/1/536782/100/0/threaded - http://www.securityfocus.com/bid/77361 - http://seclists.org/fulldisclosure/2015/Oct/103
CVE ID: CVE-2015-7725 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL commands via the (1) remoteSourceName in the dropCredentials function or unspecified vectors in the (2) setTraceLevelsForXsApps, (3) _modifyUser, or (4) _newUser function, aka SAP Security Notes 2153898 and 2153765. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133764/SAP-HANA-setTraceLevelsForXsApps-
es: - CVE Program Container: References: - http://packetstormsecurity.com/files/133764/SAP-HANA-setTraceLevelsForXsApps-SQL-Injection.html - https://www.onapsis.com/research/security-advisories/sap-hana-sql-injection-modifyuser - https://www.onapsis.com/research/security-advisories/sap-hana-drop-credentials-sql-injection - http://seclists.org/fulldisclosure/2015/Sep/118 - http://packetstormsecurity.com/files/133762/SAP-HANA-_newUser-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Sep/111 - https://www.onapsis.com/research/security-advisories/sap-hana-sql-injection-newuser - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://packetstormsecurity.co
ion-newuser - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition - http://packetstormsecurity.com/files/133761/SAP-HANA-_modifyUser-SQL-Injection.html - https://www.onapsis.com/research/security-advisories/sap-sql-injection-settracelevelsforxsapps - http://packetstormsecurity.com/files/133769/SAP-HANA-Drop-Credentials-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Sep/110 - http://seclists.org/fulldisclosure/2015/Sep/113
CVE ID: CVE-2015-7726 State: PUBLISHED Published: 2015-10-15T20:00:00 Last Updated: 2024-08-06T07:58:59.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/sap-hana-xss-role-deletion-through-web-based-workbench - http://seclists.org/fulldisclosure/2015/Sep/114 - https://www.onapsis.com/blog/analyzing-sap-securi
eb-based-workbench - http://seclists.org/fulldisclosure/2015/Sep/114 - https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition