Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2907 State: PUBLISHED Published: 2015-08-23T21:00:00 Last Updated: 2024-08-06T05:32:20.559Z Vendors: Munic Products: Mobile Devices (MDI) OBD-II dongles Problem Types: n/a Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/woot15/workshop-program/presentation/foster - http://www.kb.cert.org/vuls/id/209512
CVE ID: CVE-2015-2908 State: PUBLISHED Published: 2015-08-23T21:00:00 Last Updated: 2024-08-06T05:32:20.499Z Vendors: Munic Products: Mobile Devices (MDI) OBD-II dongles Problem Types: n/a Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/woot15/workshop-program/presentation/foster - http://www.kb.cert.org/vuls/id/209512
CVE ID: CVE-2015-2909 State: PUBLISHED Published: 2020-02-06T14:14:50 Last Updated: 2024-08-06T05:32:20.363Z Vendors: Dedicated Micros Products: DV-IP Express, SD Advanced, SD, EcoSense, DS2 Problem Types: Other Description: Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords." Additional Analyst Notes: - CVE Program Container: References:
on the GUI that they should set usernames and passwords." Additional Analyst Notes: - CVE Program Container: References: - http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/ - http://www.kb.cert.org/vuls/id/276148
CVE ID: CVE-2015-2912 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/845332 - https://github.com/orientechnologies/orientdb/issues/4824
CVE ID: CVE-2015-2913 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/845332 - https://github.com/orientechnologies/orientdb/commit/668ece
iner: References: - https://www.kb.cert.org/vuls/id/845332 - https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104
CVE ID: CVE-2015-2914 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T05:32:20.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by using this number for the destination port, a different vulnerability than CVE-2015-7296. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/906576
CVE ID: CVE-2015-2915 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T05:32:20.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the intranet. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/906576
CVE ID: CVE-2015-2916 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T05:32:20.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/906576
CVE ID: CVE-2015-2917 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T05:32:20.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/906576
CVE ID: CVE-2015-2918 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T05:32:20.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/845332
CVE ID: CVE-2015-2922 State: PUBLISHED Published: 2015-05-27T10:00:00 Last Updated: 2024-08-06T05:32:20.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html - http://www.
/2015-April/155908.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.debian.org/security/2015/dsa-3237 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html - http://www.securitytracker.com/id/1032417 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - http://www.openwall.com/lists/oss-security/2015/04/04/2 - https://bugzilla.redhat.com/show_bug.cgi?id=1203712 - ht
tml - http://www.openwall.com/lists/oss-security/2015/04/04/2 - https://bugzilla.redhat.com/show_bug.cgi?id=1203712 - http://rhn.redhat.com/errata/RHSA-2015-1534.html - http://rhn.redhat.com/errata/RHSA-2015-1564.html - https://github.com/torvalds/linux/commit/6fd99094de2b83d1d4c8457f2c83483b2828e75a - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://www.securityfocus.com/bid/74315 - http://rhn.redhat.com/errata/RHSA-2015-1221.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6fd99094de2b83d1d4c8457f2c83483b2828e75a - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2015-2923 State: PUBLISHED Published: 2020-02-20T03:28:30 Last Updated: 2024-08-06T05:32:20.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/04/04/2 - https://lists.freebsd.org/pipermail/freebsd-net/2015-April/041934.html - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:09.ipv6.asc - https://git.kernel.org/pub/scm/linux/kernel/git
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:09.ipv6.asc - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6fd99094de2b83d1d4c8457f2c83483b2828e75a
CVE ID: CVE-2015-2924 State: PUBLISHED Published: 2015-11-16T21:00:00 Last Updated: 2024-08-06T05:32:20.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/04/04/2 - https://security.gentoo.org/glsa/201509-05 - http://www.securityfocus.com/bid/76879 - http://lists.fedorapro
5/04/04/2 - https://security.gentoo.org/glsa/201509-05 - http://www.securityfocus.com/bid/76879 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158103.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157803.html
CVE ID: CVE-2015-2925 State: PUBLISHED Published: 2015-11-16T11:00:00 Last Updated: 2024-08-06T05:32:20.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html - http://rhn.redhat.com/errata/RHSA-2015-2636.html - http://www.debian.org/security/2015/dsa-3372 - http://permalink.
ml - http://rhn.redhat.com/errata/RHSA-2015-2636.html - http://www.debian.org/security/2015/dsa-3372 - http://permalink.gmane.org/gmane.linux.kernel.containers/29173 - http://rhn.redhat.com/errata/RHSA-2016-0068.html - http://pkgs.fedoraproject.org/cgit/kernel.git/commit/?h=f22&id=520b64102de2f184036024b2a53de2b67463bd78 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html - http://www.ubuntu.com/usn/USN-2792-1 - http://www.securityfocus.com/bid/73926 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html - http://www.debian.org/security/2015/dsa-3364 - http://www.ubuntu.com/usn/USN-2794-1 - http://www.ubuntu.com/usn/USN-2799-1 - http://www.ubunt
/security/2015/dsa-3364 - http://www.ubuntu.com/usn/USN-2794-1 - http://www.ubuntu.com/usn/USN-2799-1 - http://www.ubuntu.com/usn/USN-2795-1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://permalink.gmane.org/gmane.linux.kernel.containers/29177 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html - http://git.k
inux.kernel.containers/29177 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html - http://www.openwall.com/lists/oss-security/2015/04/04/4 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4 - https://bugzilla.redhat.com/show_bug.cgi?id=1209367 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html - https://github.com/torvalds/li
b8dac30c37 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html - https://github.com/torvalds/linux/commit/cde93be45a8a90d8c264c776fab63487b5038a65 - https://bugzilla.redhat.com/show_bug.cgi?id=1209373 - https://github.com/torvalds/linux/commit/397d425dc26da728396e66d392d5dcb8dac30c37 - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html - http://www.ubuntu.com/usn/USN-2798-1
CVE ID: CVE-2015-2926 State: PUBLISHED Published: 2015-04-14T14:00:00 Last Updated: 2024-08-06T05:32:20.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131332/phpTrafficA-2.3-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/74046 - http://www.securityfocus.com/archive/1/535212/100/0/threaded
CVE ID: CVE-2015-2927 State: PUBLISHED Published: 2017-09-20T18:00:00 Last Updated: 2024-08-06T05:32:20.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1209781 - http://www.openwall.com/lists/oss-security/2015/04/06/3 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777013 - https://support.f5.com/csp/article/K64462543?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2015-2928 State: PUBLISHED Published: 2020-01-24T17:22:15 Last Updated: 2024-08-06T05:32:20.595Z Vendors: The Tor Project Products: Tor Problem Types: Other Description: The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://trac.torproject.org/projects/tor/ticket/15600 - http://openwall.com/lists/oss-security/2015/04/06/5
CVE ID: CVE-2015-2929 State: PUBLISHED Published: 2020-01-24T17:22:27 Last Updated: 2024-08-06T05:32:20.617Z Vendors: The Tor Project Products: Tor Problem Types: Denial of Service - Malformed Input Description: The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/04/06/5 - https://trac.torproject.org/projects/tor/ticket/15601
CVE ID: CVE-2015-2931 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - https://phabricator.wikimedia.org/T85850
rity/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - https://phabricator.wikimedia.org/T85850 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
CVE ID: CVE-2015-2932 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/0
/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T86711
CVE ID: CVE-2015-2933 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:21.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2
y/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T73394
CVE ID: CVE-2015-2934 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3
s?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T88310
CVE ID: CVE-2015-2935 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http:/
VSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T85349
CVE ID: CVE-2015-2936 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - https://phabricator.wikimedia.org/T64685 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04
bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
CVE ID: CVE-2015-2937 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 -
ences: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T71210
CVE ID: CVE-2015-2938 State: PUBLISHED Published: 2015-04-13T14:00:00 Last Updated: 2024-08-06T05:32:20.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201510-05 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/
ories?name=MDVSA-2015:200 - http://www.securityfocus.com/bid/73477 - http://www.openwall.com/lists/oss-security/2015/04/07/3 - http://www.openwall.com/lists/oss-security/2015/04/01/1 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html - https://phabricator.wikimedia.org/T85855