Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130292/u5CMS-3.9.3-Cross-Site-Scripting.html - http://www.exploit-db.com/exploits/36029 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5223.php
CVE ID: CVE-2015-1576 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-16T17:54:17.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130326/u5CMS-3.9.3-SQL-Injection.html - http://www.
rogram Container: References: - http://packetstormsecurity.com/files/130326/u5CMS-3.9.3-SQL-Injection.html - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php
CVE ID: CVE-2015-1577 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-16T17:03:54.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/36026 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php - http://packetstormsecurity.com/files/130325/u5CMS-3.9.3-Arbitrary-File-Deletion.html
CVE ID: CVE-2015-1578 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-16T23:25:28.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php - http://packetstormsecurity.com/files/130317/u5CMS-3.9.3-Open-Redirect.html
CVE ID: CVE-2015-1579 State: PUBLISHED Published: 2015-02-11T19:00:00 Last Updated: 2024-08-06T04:47:17.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/7540 - http://www.exploit-db.com/exploits/36039
CVE ID: CVE-2015-1580 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-17T01:42:07.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) source or (3) redir parameter in an add action in the redirection-page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130314/WordPress-Redirection-Page-1.2-CSRF-X
- CVE Program Container: References: - http://packetstormsecurity.com/files/130314/WordPress-Redirection-Page-1.2-CSRF-XSS.html
CVE ID: CVE-2015-1581 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-17T02:10:35.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecuri
wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130316/WordPress-Mobile-Domain-1.5.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2015-1582 State: PUBLISHED Published: 2015-02-11T19:00:00Z Last Updated: 2024-09-16T19:46:22.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectposts
arameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/spider-facebook/changelog/ - http://packetstormsecurity.com/files/130318/WordPress-Spider-Facebook-1.0.10-Cross-Site-Scripting.html
CVE ID: CVE-2015-1583 State: PUBLISHED Published: 2020-03-02T15:50:35 Last Updated: 2024-08-06T04:47:17.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130598/ATutor-LCMS-2.2-Cross-Site-Request-Forgery.html - http://www.securityfocus.com/bid/72845 - htt
security.com/files/130598/ATutor-LCMS-2.2-Cross-Site-Request-Forgery.html - http://www.securityfocus.com/bid/72845 - https://github.com/atutor/ATutor/commit/068b8aa37f24645c62235018fb8da340f60e2d18 - https://github.com/atutor/ATutor/commit/0ee827317e497f1db86ddc5080b8af461e4595ce - https://github.com/atutor/ATutor/commit/af519cfb56da7312eecbb5812484fcbce08e4419 - https://edricteo.com/cve-2015-1583-atutor-lcms-csrf-vulnerability/
CVE ID: CVE-2015-1585 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T04:47:17.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29 - http://www.securityfocus.com/archive/1/534709/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/100925 - http://packetstormsecu
m/archive/1/534709/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/100925 - http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html
CVE ID: CVE-2015-1587 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T04:47:16.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35113 - http://packetstormsecurity.com/files/130383/Maarch-LetterBox-2.8-Unrestricted-File-Upload.html - http://asylum.seraum.com/Security-Alert-
msecurity.com/files/130383/Maarch-LetterBox-2.8-Unrestricted-File-Upload.html - http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html - http://osvdb.org/show/osvdb/113928
CVE ID: CVE-2015-1588 State: PUBLISHED Published: 2017-06-08T21:00:00 Last Updated: 2024-08-06T04:47:17.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032202 - http://www.securityfocus.com/bid/74350 - http://packetstormsecurity.com/files/131649/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/535388/100/1100/threaded
CVE ID: CVE-2015-1589 State: PUBLISHED Published: 2015-02-23T17:00:00 Last Updated: 2024-08-06T04:47:17.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776164 - http://www.openwall.com/lists/oss-security/2015/02/12/9 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100879 - http://www.openwall.com/lists/oss-security/2015/02/12/16
CVE ID: CVE-2015-1590 State: PUBLISHED Published: 2017-09-07T14:00:00 Last Updated: 2024-08-06T04:47:16.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/02/12/7 - https://github.com/kamailio/kamailio/issues/48 - https://github.com/kamailio/kamailio/blob/4.3.0/ChangeLog#L2038 - https://github.com/kamailio/kamailio/commit/06177b12936146d48378cc5f6c6e1b157ebd519b - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681
CVE ID: CVE-2015-1591 State: PUBLISHED Published: 2017-06-27T20:00:00 Last Updated: 2024-08-06T04:47:16.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/02/12/7 - https://github.com/kamailio/kamailio/issues/48 - https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=17%3Bfilename=0001-fix-fifo-and-ctl-defaults-pointing-to-unsecure-tmp-d.patch%3Batt=1%3Bbug=775681 - https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1591.html - http://cve.killedkenny.io/cve/CVE-2015-1
1 - https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1591.html - http://cve.killedkenny.io/cve/CVE-2015-1591 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681
CVE ID: CVE-2015-1592 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T04:47:17.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2015/dsa-3183 - http://www.securitytracker.com/id/1031777 - http://www.openwall.com/lists/oss-security/2015/02/12/2 - https://exchange.xforc
://www.securitytracker.com/id/1031777 - http://www.openwall.com/lists/oss-security/2015/02/12/2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100912 - https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html - http://www.securityfocus.com/bid/72606 - http://www.openwall.com/lists/oss-security/2015/02/12/17
CVE ID: CVE-2015-1593 State: PUBLISHED Published: 2015-03-16T10:00:00 Last Updated: 2024-08-06T04:47:17.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/4e7c22d447bb6
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.1 - http://www.debian.org/security/2015/dsa-3170 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html - http://www.ubuntu.com/usn/USN-2562-1 - http://www.ubuntu.com/usn/USN-2565-1 - http://www.ubuntu.com/usn/USN-2561-1 - http://www.securityfocus.com/bid/72607 - http://www.ubuntu.com/usn/USN-2564-1 - http://www.ubuntu.com/usn/USN-2563-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 - http
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 - http://rhn.redhat.com/errata/RHSA-2015-1138.html - http://hmarco.org/bugs/linux-ASLR-integer-overflow.html - http://www.ubuntu.com/usn/USN-2560-1 - http://www.openwall.com/lists/oss-security/2015/02/13/13 - https://bugzilla.redhat.com/show_bug.cgi?id=1192519 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html - http://rhn.redhat.com/errata/RHSA-2015-1137.html - https://lkml.org/lkml/2015/1/7/811 - http://rhn.redhat.com/errata/RHSA-2015-1221.html - https://access.redhat.com/errata/RHSA-2019:3517
CVE ID: CVE-2015-1594 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:16.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf - http://www.securi
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf - http://www.securitytracker.com/id/1032039
CVE ID: CVE-2015-1595 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:17.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE ID: CVE-2015-1596 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:17.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE ID: CVE-2015-1597 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:17.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE ID: CVE-2015-1598 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:17.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device filesystem. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE ID: CVE-2015-1599 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T04:47:17.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE ID: CVE-2015-1600 State: PUBLISHED Published: 2017-08-28T19:00:00 Last Updated: 2024-08-06T04:47:17.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72622 - https://isc.sans.edu/forums/diary/Did+You+Remove+That+Debug+Code+Netatmo+Weather+Station+Sending+WPA+Passphrase+in+the+Clear/19327 - http://packetstormsecurity.com/files/130401/Netatmo-Weather-Station-Cleartext-Password-Leak.html - http://www.securityfocus.com/archive/1/534707/100/1600/threaded
CVE ID: CVE-2015-1601 State: PUBLISHED Published: 2015-04-06T01:00:00 Last Updated: 2024-08-06T04:47:17.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72691 - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-315836.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-487246.pdf
CVE ID: CVE-2015-1602 State: PUBLISHED Published: 2015-04-06T01:00:00 Last Updated: 2024-08-06T04:47:17.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-315836.pdf
CVE ID: CVE-2015-1603 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T04:47:17.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/50 - http://www.securityfocus.com/bid/72605 - http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - http://packetstormsecurity.com/files/130
ttp://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html - http://www.openwall.com/lists/oss-security/2015/02/14/5 - http://www.openwall.com/lists/oss-security/2015/02/13/11 - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-14.html - https://github.com/kneecht/adminsystems/releases/tag/4.0.2 - https://github.com/kneecht/adminsystems/issues/1 - http://www.openwall.com/lists/oss-security/2015/02/14/1
CVE ID: CVE-2015-1604 State: PUBLISHED Published: 2015-02-19T15:00:00 Last Updated: 2024-08-06T04:47:17.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Feb/50 - http://www.securityfocus.com/bid/72605 - http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - http://packetstormsecu
.com/bid/72605 - http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html - http://www.openwall.com/lists/oss-security/2015/02/14/5 - http://www.openwall.com/lists/oss-security/2015/02/13/11 - https://github.com/kneecht/adminsystems/releases/tag/4.0.2 - https://github.com/kneecht/adminsystems/issues/1 - http://www.openwall.com/lists/oss-security/2015/02/14/1
CVE ID: CVE-2015-1605 State: PUBLISHED Published: 2015-02-24T15:00:00 Last Updated: 2024-08-06T04:47:17.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-049/ - http://www.securityfocus.com/bid/72697 - http://www.zerodayinitiative.com/advisories/ZDI-15-048/
CVE ID: CVE-2015-1606 State: PUBLISHED Published: 2019-11-20T18:30:47 Last Updated: 2024-08-06T04:47:17.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file. Additional Analyst Notes: - CVE Program Container: References: - https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html - http://www.debian.org/security/2015/dsa-3184 - http://www.openwall.com/lists/oss-security/2015/02/13/14 - http://www.openwall.com/lists/oss-security/2015/02/