Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-4553 State: PUBLISHED Published: 2020-01-06T20:54:57 Last Updated: 2024-08-06T06:18:11.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75285 - http://seclists.org/fulldisclosure/2015/Jun/47 - https://www.exploit-db.com/exploits/37423/
CVE ID: CVE-2015-4554 State: PUBLISHED Published: 2015-07-21T19:00:00 Last Updated: 2024-08-06T06:18:12.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Deskt
6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033015 - http://www.tibco.com/mk/advisory.jsp - http://www.tibco.com/assets/blt
es: - http://www.securitytracker.com/id/1033015 - http://www.tibco.com/mk/advisory.jsp - http://www.tibco.com/assets/blt1fd126faba191a9f/2015-001-advisory.txt
CVE ID: CVE-2015-4555 State: PUBLISHED Published: 2015-08-30T14:00:00 Last Updated: 2024-08-06T06:18:12.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Rendezvous Daemon (rvd), Routing Daemon (rvrd), Secure Daemon (rvsd), Secure Routing Daemon (rvsrd), Gateway Daemon (rvgd), Daemon Adapter (rvda), Cache (rvcache), Agent (rva), and Relay Agent (rvrad) components.
(rvsrd), Gateway Daemon (rvgd), Daemon Adapter (rvda), Cache (rvcache), Agent (rva), and Relay Agent (rvrad) components. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033677 - http://www.tibco.com/mk/advisory.jsp - http://www.tibco.com/assets/blt18493dc775c50c09/2015-002-advisory.txt
CVE ID: CVE-2015-4556 State: PUBLISHED Published: 2017-03-29T14:00:00 Last Updated: 2024-08-06T06:18:11.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1231871 - http://seclists.org/oss-sec/2015/q2/712 - http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html - http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html - https://security.gentoo.org/glsa/201612-54 - http://www.securityfocus
hive/html/chicken-announce/2015-06/msg00010.html - https://security.gentoo.org/glsa/201612-54 - http://www.securityfocus.com/bid/97293
CVE ID: CVE-2015-4557 State: PUBLISHED Published: 2018-04-12T15:00:00 Last Updated: 2024-08-06T06:18:11.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jun/71 - http://www.securityfocus.com/bid/75395 - http://packetstormsecurity.com/files/132432/WordPress-Nextend-Twitte
5/Jun/71 - http://www.securityfocus.com/bid/75395 - http://packetstormsecurity.com/files/132432/WordPress-Nextend-Twitter-Connect-1.5.1-Cross-Site-Scripting.html - https://plugins.trac.wordpress.org/changeset/1178744/nextend-twitter-connect
CVE ID: CVE-2015-4559 State: PUBLISHED Published: 2015-06-15T15:00:00 Last Updated: 2024-08-06T06:18:12.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10121 - http://www.securitytracker.com/id/1032671 - http://www.securityfocus.com/bid/91539
CVE ID: CVE-2015-4582 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T17:35:12.477Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: TheCartPress Products: boot-store Problem Types: CWE-79 Description: The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://themes.trac.wordpress.org/browser/boot-store/1.6.4/header.php#L348
CVE ID: CVE-2015-4586 State: PUBLISHED Published: 2015-06-23T14:00:00 Last Updated: 2024-08-06T06:18:11.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75384 - http://packetstormsecurity.com/files/132324/CellPipe-7130-Cross-Site-Request-Forgery.html
CVE ID: CVE-2015-4587 State: PUBLISHED Published: 2015-06-18T18:00:00 Last Updated: 2024-08-06T06:18:11.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Alcatel-Lucent CellPipe 7130 router with firmware 1.0.0.20h.HOL allows remote attackers to inject arbitrary web script or HTML via the "Custom application" field in the "port triggering" menu. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75305 - http://packetstormsecurity.com/files/132327/CellPipe-7130-Cross-Site-Scripting.html
CVE ID: CVE-2015-4588 State: PUBLISHED Published: 2015-07-01T14:00:00 Last Updated: 2024-08-06T06:18:12.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3302 - http://www.openwall.com/lists/oss-security/2015/06/03/6 - http://lists.opensuse.org/opensuse-updates/2015-06/msg00051.html - https://security.gentoo.org/glsa/201602-03 - http://lists.fedorapr
opensuse.org/opensuse-updates/2015-06/msg00051.html - https://security.gentoo.org/glsa/201602-03 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160668.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.ubuntu.com/usn/USN-2670-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1227243 - http://lists.opensuse.org/opensuse-updates/2015-06/msg00053.html - http://www.openwall.com/lists/oss-security/2015/06/16/4 - http://www.securityfocus.com/bid/75230 - http://www.securitytracker.com/id/1032771 - http://lists.opensuse.org/opensuse-updates/2015-07/msg00018.html - http://rhn.redhat.com/errata/RHSA-2015-1917.html
CVE ID: CVE-2015-4590 State: PUBLISHED Published: 2015-06-22T18:00:00 Last Updated: 2024-08-06T06:18:11.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bblanchon/ArduinoJson/commit/5e7b9ec688d79e7b16ec7064e1d37e8481a31e72 - https://github.com/bblanchon/ArduinoJson/pull/81 - http://www.openwall.com/lists/oss-security
16ec7064e1d37e8481a31e72 - https://github.com/bblanchon/ArduinoJson/pull/81 - http://www.openwall.com/lists/oss-security/2015/06/16/6 - https://github.com/bblanchon/ArduinoJson/blob/master/CHANGELOG.md - http://www.securityfocus.com/bid/75150
CVE ID: CVE-2015-4591 State: PUBLISHED Published: 2017-01-10T15:00:00 Last Updated: 2024-08-06T06:18:12.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated users to inject arbitrary javascript via the strMessage parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39402/ - http://www.securityfocus.com/archive/1/537420/100/0/threaded - http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html
CVE ID: CVE-2015-4592 State: PUBLISHED Published: 2017-01-10T15:00:00 Last Updated: 2024-08-06T06:18:11.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39402/ - http://www.securityfocus.com/archive/1/537420/100/0/threaded - http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html
CVE ID: CVE-2015-4593 State: PUBLISHED Published: 2017-01-10T15:00:00 Last Updated: 2024-08-06T06:18:12.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39402/ - http://www.securityfocus.com/archive/1/537420/100/0/threaded - http://packetstormsecurity.com/files
om/exploits/39402/ - http://www.securityfocus.com/archive/1/537420/100/0/threaded - http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html
CVE ID: CVE-2015-4594 State: PUBLISHED Published: 2017-01-10T15:00:00 Last Updated: 2024-08-06T06:18:11.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39402/ - http://www.securityfocus.com/archive/1/537420/100/0/threaded - http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html
CVE ID: CVE-2015-4596 State: PUBLISHED Published: 2017-06-13T16:00:00.000Z Last Updated: 2025-05-30T15:18:33.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/len_2015_066 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2015-4596
CVE ID: CVE-2015-4598 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errat
write to only .html files. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.debian.org/security/2015/dsa-3344 - http://rhn.redhat.com/errata/RHSA-2015-1219.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69719 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://www.securityfocus.com/bid/75244 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4599 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032709 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.sec
er.com/id/1032709 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.securityfocus.com/bid/75251 - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69152 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4600 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods. Additional Analyst Notes: - CVE Pr
sponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032709 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLog-5.php - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8 - https://bugs.php.net/bug.php?id=69152 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://www.securityfocus.com/bid/74413 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4601 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032709 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLo
/1032709 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLog-5.php - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8 - http://www.securityfocus.com/bid/75246 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4602 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www
15-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69152 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1 - http://www.securityfocus.com/bid/75249 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4603 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2
p://rhn.redhat.com/errata/RHSA-2015-1186.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=69152 - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://rhn.redhat.com/errata/RHSA-2015-1135.html - http://www.securityfocus.com/bid/75252 - http://rhn.redhat.com/errata/RHSA-2015-1218.html
CVE ID: CVE-2015-4604 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.se
l Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - https://bugs.php.net/bug.php?id=68819 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.securityfocus.com/bid/75241 - http://php.net/ChangeLog-5.php - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f938112c495b0d26572435c0be73ac0bfe642ecd - http://rhn.redhat.com/errata/RHSA-2015-1135.html
CVE ID: CVE-2015-4605 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T06:18:12.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securityt
st Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1187.html - http://www.securitytracker.com/id/1032709 - http://rhn.redhat.com/errata/RHSA-2015-1186.html - https://bugs.php.net/bug.php?id=68819 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.securityfocus.com/bid/75233 - http://php.net/ChangeLog-5.php - http://www.openwall.com/lists/oss-security/2015/06/16/12 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f938112c495b0d26572435c0be73ac0bfe642ecd - http://rhn.redhat.com/errata/RHSA-2015-1135.html
CVE ID: CVE-2015-4606 State: PUBLISHED Published: 2015-06-16T16:00:00 Last Updated: 2024-08-06T06:18:12.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75238 - http://typo3.org/extensions/repository/view/jobfair - http://typo3.org/teams/security/security-bulletins/typo3-
/75238 - http://typo3.org/extensions/repository/view/jobfair - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/