Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7236 State: PUBLISHED Published: 2015-10-01T20:00:00 Last Updated: 2024-08-06T07:43:45.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - https://security.gentoo.org/glsa/201611-17 - http://www.spinics.net/lists/linux-nfs/msg53045.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-Nove
tp://www.spinics.net/lists/linux-nfs/msg53045.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172152.html - http://www.openwall.com/lists/oss-security/2015/09/17/6 - http://www.ubuntu.com/usn/USN-2756-1 - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html - http://www.openwall.com/lists/oss-security/2015/09/17/1 - http://www.securityfocus.com/bid/76771 - http://www.securitytracker.com/id/1033673 - https://security.FreeBSD.org/advisories/FreeBSD-SA-15:24.rpcbind.asc - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171030.html - http://www.debian.org/security/2015/dsa-3366
CVE ID: CVE-2015-7237 State: PUBLISHED Published: 2015-09-18T14:00:00Z Last Updated: 2024-09-16T19:51:14.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10130 - http://www.securitytracker.com/id/1033450
CVE ID: CVE-2015-7238 State: PUBLISHED Published: 2015-09-18T14:00:00Z Last Updated: 2024-09-16T18:13:13.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10132
CVE ID: CVE-2015-7239 State: PUBLISHED Published: 2015-09-18T14:00:00 Last Updated: 2024-08-06T07:43:45.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-15-021-sap-netweaver-7-4-bp_find_jobs_with_program-sql-injection/ - http://www.securityfocus.com/archive/1/537109/100/0/threaded - http://seclists.org/fulldisclosure/2015/Dec/66 - http://packetstormsecurity.com/files/134801/SAP-NetWeav
00/0/threaded - http://seclists.org/fulldisclosure/2015/Dec/66 - http://packetstormsecurity.com/files/134801/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html
CVE ID: CVE-2015-7241 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T07:43:45.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133627/SAP-Netweaver-XML-External-Entity-Injection.html - http://www.securityfocus.com/archive/1/536504/100/0/threaded - https://www.exploit-db.com/exploits/38261/ - http://www.securityfocus.com/bid/76809
CVE ID: CVE-2015-7242 State: PUBLISHED Published: 2016-01-12T19:00:00 Last Updated: 2024-08-06T07:43:45.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135168/AVM-FRITZ-OS-HTML-Injection.html - http://ds-develop.de/advisories/advisory-2016-01-07-1-avm.txt - https://avm.de/service/sicherheitsinfos-zu-updates/ - http://www.securityfocus.com/archive/1/
ory-2016-01-07-1-avm.txt - https://avm.de/service/sicherheitsinfos-zu-updates/ - http://www.securityfocus.com/archive/1/537249/100/0/threaded
CVE ID: CVE-2015-7243 State: PUBLISHED Published: 2015-09-18T16:00:00 Last Updated: 2024-08-06T07:43:45.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137277/Boxoft-Wav-To-MP3-Converter-1.0-Buffer-Overflow.html - https://www.exploit-db.com/exploits/38035/ - https://www.exploit-db.com/exploits/44971/ - http://packetstormsecurity.com/files/133377/Boxoft-WAV-To-MP3-Converter-Buffer-Overflow.html
CVE ID: CVE-2015-7244 State: PUBLISHED Published: 2015-11-04T02:00:00 Last Updated: 2024-08-06T07:43:45.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets. Additional Analyst Notes: - CVE Program Container: References: - http://blog.mobatek.net/post/mobaxterm-new-release-8.3/ - http://www.securifera.com/advisories/cve-2015-7244 - http://www.kb.cert.org/vuls/id/316888
CVE ID: CVE-2015-7245 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:43:45.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html - http://seclists.org/fulldisclosure/2016/Feb/24 - https://www.exploit-db.com/exploits/39409/
CVE ID: CVE-2015-7246 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:43:45.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html - http://seclists.org/fulldisclosure/2016/Feb/24 - https://www.exploit-db.com/exploits/39409/
CVE ID: CVE-2015-7247 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T07:43:45.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html - http://seclists.org/fulldisclosure/2016/Feb/24 - https://www.exploit-db.com/exploits/394
l-Information-Disclosure.html - http://seclists.org/fulldisclosure/2016/Feb/24 - https://www.exploit-db.com/exploits/39409/
CVE ID: CVE-2015-7248 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T07:43:45.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77421 - https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA - https://www.kb.cert.org/vuls/id/391604 - https://www.exploit-db.com/exploits/38773/
CVE ID: CVE-2015-7249 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T07:43:45.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77421 - https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA - https://www.kb.cert.org/vuls/id/391604 - https://www.exploit-db.com/exploits/38773/
CVE ID: CVE-2015-7250 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T07:43:45.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77421 - https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA - https://www.kb.cert.org/vuls/id/391604 - https://www.exploit-db.com/exploits/38773/
CVE ID: CVE-2015-7251 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T07:43:45.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77421 - https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA - https://www.kb.cert.org/vuls/id/391604 - https://www.exploit-db.com/exploits/38773/
CVE ID: CVE-2015-7252 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T07:43:45.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77421 - https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA - https://www.kb.cert.org/vuls/id/391604 - https://www.exploit-db.com/exploits/38773/
CVE ID: CVE-2015-7253 State: PUBLISHED Published: 2015-11-04T02:00:00 Last Updated: 2024-08-06T07:43:45.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/866432
CVE ID: CVE-2015-7254 State: PUBLISHED Published: 2015-11-07T02:00:00 Last Updated: 2024-08-06T07:43:46.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45991/ - http://www.kb.cert.org/vuls/id/438928 - https://github.com/0xAdrian/scripts/blob/master/2015_7254_exploit.py - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462908.htm - http://www.securityfocus.com/bid/77506 - http://www.
curity/psirt/security-bulletins/security-advisories/hw-462908.htm - http://www.securityfocus.com/bid/77506 - http://www.huawei.com/en/psirt/security-advisories/hw-462908
CVE ID: CVE-2015-7255 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-06T07:43:46.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/566724 - https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93 - https://www.kb.c
org/vuls/id/566724 - https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93 - https://www.kb.cert.org/vuls/id/BLUU-A2NQYR
CVE ID: CVE-2015-7256 State: PUBLISHED Published: 2017-09-27T18:00:00 Last Updated: 2024-08-06T07:43:45.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000 small business gateways; GS1900-8 and GS1900-24 switches; and C1000Z, Q1000, FR1000Z, and P8702N project models use non-unique X.509 certificates and SSH host keys. Additional Analyst Notes: - CVE Program Container: References: - http:
non-unique X.509 certificates and SSH host keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/566724 - http://www.zyxel.com/support/announcement_SSH_private_key_and_certificate_vulnerability.shtml
CVE ID: CVE-2015-7257 State: PUBLISHED Published: 2017-08-24T20:00:00 Last Updated: 2024-08-06T07:43:46.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin". Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/38772/ - http://seclists.org/fulldisclosure/2015/Nov/48 - http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.ht
osure/2015/Nov/48 - http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html - http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html
CVE ID: CVE-2015-7258 State: PUBLISHED Published: 2017-08-24T20:00:00 Last Updated: 2024-08-06T07:43:46.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/38772/ - http://seclists.org/fulldisclosure/2015/Nov/48 - http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html - http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Info
-Authorization-Disclosure-Backdoor.html - http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html
CVE ID: CVE-2015-7259 State: PUBLISHED Published: 2017-08-24T20:00:00 Last Updated: 2024-08-06T07:43:46.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/38772/ - http://seclists.org/fulldisclosure/2015/Nov/48 - http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html - http:/
Nov/48 - http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html - http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html
CVE ID: CVE-2015-7260 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.053Z Vendors: n/a Products: Liebert MultiLink Automated Shutdown v4.2.4 Problem Types: Privilege Escalation Description: Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file. Additional Analyst Notes: - CVE Program Container: References: - https://stealthsploit.com/2015/10/27/vulnerability-disclosures/
CVE ID: CVE-2015-7261 State: PUBLISHED Published: 2016-02-27T02:00:00 Last Updated: 2024-08-06T07:43:46.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/444472
CVE ID: CVE-2015-7262 State: PUBLISHED Published: 2016-02-27T02:00:00 Last Updated: 2024-08-06T07:43:46.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/444472
CVE ID: CVE-2015-7263 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.109Z Vendors: n/a Products: Facebook Proxygen before 2015-11-09 Problem Types: Unsafe URL encoding Description: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE ID: CVE-2015-7264 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.122Z Vendors: n/a Products: Facebook Proxygen before 2015-11-09 Problem Types: truncation Description: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE ID: CVE-2015-7265 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.082Z Vendors: n/a Products: Facebook Proxygen before 2015-11-09 Problem Types: mismanages state Description: Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE ID: CVE-2015-7266 State: PUBLISHED Published: 2018-10-30T17:00:00 Last Updated: 2024-08-06T07:43:46.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentially compromise bid integrity by leveraging failure to limit the time between bid responses and impression notifications, aka the Amnesia Bug. Additional Analyst Notes: - CVE Program Container: References: - http://media.pixalate.com/white-papers/xindi.pdf
CVE ID: CVE-2015-7267 State: PUBLISHED Published: 2017-11-27T22:00:00 Last Updated: 2024-08-06T07:43:46.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opal or eDrive mode on Lenovo ThinkPad T440s laptops with BIOS 2.32; ThinkPad W541 laptops with BIOS 2.21; Dell Latitude E6410 laptops with BIOS A16; or Latitude E6430 laptops with BIOS A16, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by leveraging failure to detect when SATA drives are unplugged in Sleep Mode, aka a "Hot Plug attack." Additional Anal
n by leveraging failure to detect when SATA drives are unplugged in Sleep Mode, aka a "Hot Plug attack." Additional Analyst Notes: - CVE Program Container: References: - https://www.infoworld.com/article/3004913/encryption/self-encrypting-drives-are-hardly-any-better-than-software-based-encryption.html - https://www.blackhat.com/docs/eu-15/materials/eu-15-Boteanu-Bypassing-Self-Encrypting-Drives-SED-In-Enterprise-Environments-wp.pdf
CVE ID: CVE-2015-7268 State: PUBLISHED Published: 2017-11-27T22:00:00 Last Updated: 2024-08-06T07:43:46.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in Opal mode on Lenovo ThinkPad T440s laptops with BIOS 2.32 or ThinkPad W541 laptops with BIOS 2.21, or in Opal or eDrive mode on Dell Latitude E6410 laptops with BIOS A16 or Latitude E6430 laptops with BIOS A16, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by triggering a soft reset and booting from an alternative OS, aka a "Forced Restart Attack." Ad
drive (SED) protection by triggering a soft reset and booting from an alternative OS, aka a "Forced Restart Attack." Additional Analyst Notes: - CVE Program Container: References: - https://www.infoworld.com/article/3004913/encryption/self-encrypting-drives-are-hardly-any-better-than-software-based-encryption.html - https://www.blackhat.com/docs/eu-15/materials/eu-15-Boteanu-Bypassing-Self-Encrypting-Drives-SED-In-Enterprise-Environments-wp.pdf
CVE ID: CVE-2015-7269 State: PUBLISHED Published: 2017-11-27T22:00:00 Last Updated: 2024-08-06T07:43:46.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by attaching a second SATA connector to exposed pins, maintaining an alternate power source, and attaching the data cable to another machine, aka a "Hot Unplug Attack." Additional Analyst Notes: - CVE Program Container: References: - https://www.infoworld.com/article/3004913/encryption/self-encrypting-drives-are-hardly-any-better
ntainer: References: - https://www.infoworld.com/article/3004913/encryption/self-encrypting-drives-are-hardly-any-better-than-software-based-encryption.html - https://www.blackhat.com/docs/eu-15/materials/eu-15-Boteanu-Bypassing-Self-Encrypting-Drives-SED-In-Enterprise-Environments-wp.pdf
CVE ID: CVE-2015-7270 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.118Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: directory traversal Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97521 - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859