Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-5610 State: PUBLISHED Published: 2015-07-21T17:00:00 Last Updated: 2024-08-06T06:59:02.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/912036 - http://www.securityfocus.c
Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/912036 - http://www.securityfocus.com/bid/75969
CVE ID: CVE-2015-5611 State: PUBLISHED Published: 2015-07-21T18:00:00 Last Updated: 2024-08-06T06:59:03.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Uconnect before 15.26.1, as used in certain Fiat Chrysler Automobiles (FCA) from 2013 to 2015 models, allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings via vectors related to modification of entertainment-system firmware and access of the CAN bus due to insufficient "Radio security protection," as demonstrated on a 2014 Jeep Cherokee Limited FWD. Additional Analyst Notes: - CVE Program Container: Refer
otection," as demonstrated on a 2014 Jeep Cherokee Limited FWD. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75993 - https://twitter.com/0xcharlie/status/623171594349842433 - http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ - http://media.fcanorthamerica.com/newsrelease.do?id=16827&mid=1 - https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 - http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep/ - http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483033/RCAK-15V461-4967.pdf - https://twitter.com/0xcharlie/status/623258479730552832 - https://twitter.com/0xcharlie/status/623195051296993280 - https:
tps://twitter.com/0xcharlie/status/623258479730552832 - https://twitter.com/0xcharlie/status/623195051296993280 - https://www.youtube.com/watch?v=MK0SrxBC1xs&feature=youtu.be - http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483036/RCLRPT-15V461-9407.pdf
CVE ID: CVE-2015-5612 State: PUBLISHED Published: 2015-09-04T15:00:00 Last Updated: 2024-08-06T06:59:02.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/07/22/3 - https://github.com/octobercms/october/issues/1302 - http://www.openwall.com/lists/oss-security/2015/07/21/5 - https://github.com/octobercms/october/commit/8a4ac533e5cd6b8f92e9ef19fbfbb2f505dc7a9a
CVE ID: CVE-2015-5613 State: PUBLISHED Published: 2017-09-27T17:00:00 Last Updated: 2024-08-06T06:59:02.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a different vulnerability than CVE-2015-5612. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/07/22/3 - https://github.com/octobercms/october/issues/1302 - https://github.com/octobercms/october/commit/8a4ac533e5cd6b8f92e9ef19fbfbb2f505dc7a9a
CVE ID: CVE-2015-5614 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-5615 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-5617 State: PUBLISHED Published: 2020-02-12T14:30:26 Last Updated: 2024-08-06T06:59:03.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133082/Enorth-Webpublisher-CMS-SQL-Injection.html - http://seclists.org/fulldisclosure/2015/Aug/55
CVE ID: CVE-2015-5618 State: PUBLISHED Published: 2015-08-01T01:00:00 Last Updated: 2024-08-06T06:59:02.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify (a) Voice Time Set configuration settings via a request to voice.htm or (b) UniFinger configuration settings via a request to bf.htm, a different vulnerability than CVE-2015-2871. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/360431
CVE ID: CVE-2015-5619 State: PUBLISHED Published: 2017-08-09T16:00:00 Last Updated: 2024-08-06T06:59:02.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76455 - https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released - http://www.securityfocus.com/archive/1/536294/100/0/threaded - http://packetstormsecurity.com/files/13326
4-5-released - http://www.securityfocus.com/archive/1/536294/100/0/threaded - http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html - http://www.securityfocus.com/archive/1/536858/100/0/threaded
CVE ID: CVE-2015-5621 State: PUBLISHED Published: 2015-08-19T15:00:00 Last Updated: 2024-08-06T06:59:02.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-09/msg00004.html - https://www.exploit-db.com/exploits/45547/ - http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6d
15-09/msg00004.html - https://www.exploit-db.com/exploits/45547/ - http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ - http://rhn.redhat.com/errata/RHSA-2015-1636.html - http://www.securitytracker.com/id/1033304 - https://bugzilla.redhat.com/show_bug.cgi?id=1212408 - http://www.ubuntu.com/usn/USN-2711-1 - http://www.openwall.com/lists/oss-security/2015/04/16/15 - http://www.openwall.com/lists/oss-security/2015/04/13/1 - http://support.citrix.com/article/CTX209443 - https://www.debian.org/security/2018/dsa-4154 - http://www.openwall.com/lists/oss-security/2015/07/31/1 - https://sourceforge.net/p/net-snmp/bugs/2615/ - http://www.securityfocus.com/bid/76380 - h
s/oss-security/2015/07/31/1 - https://sourceforge.net/p/net-snmp/bugs/2615/ - http://www.securityfocus.com/bid/76380 - https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf
CVE ID: CVE-2015-5622 State: PUBLISHED Published: 2015-08-03T14:00:00 Last Updated: 2024-08-06T06:59:02.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3328 - http://codex.wordpress.org/Version_4.2.3 - http://www.debian.org/security/2015/dsa-3332 - http://www.securitytracker.c
- http://codex.wordpress.org/Version_4.2.3 - http://www.debian.org/security/2015/dsa-3332 - http://www.securitytracker.com/id/1033037 - https://wordpress.org/news/2015/07/wordpress-4-2-3/ - http://www.securityfocus.com/bid/76011 - http://www.debian.org/security/2015/dsa-3383 - http://openwall.com/lists/oss-security/2015/07/23/18 - https://core.trac.wordpress.org/changeset/33359 - https://wpvulndb.com/vulnerabilities/8111 - https://klikki.fi/adv/wordpress3.html
CVE ID: CVE-2015-5623 State: PUBLISHED Published: 2015-08-03T14:00:00 Last Updated: 2024-08-06T06:59:02.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3328 - http://codex.wordpress.org/Version_4.2.3 - https://core.trac.wordpress.org/changeset/33357 - http://www.securitytracker.com/id/1033037 - https
.org/Version_4.2.3 - https://core.trac.wordpress.org/changeset/33357 - http://www.securitytracker.com/id/1033037 - https://wordpress.org/news/2015/07/wordpress-4-2-3/ - http://www.securityfocus.com/bid/76011 - http://openwall.com/lists/oss-security/2015/07/23/18 - https://wpvulndb.com/vulnerabilities/8111
CVE ID: CVE-2015-5624 State: PUBLISHED Published: 2015-09-07T14:00:00 Last Updated: 2024-08-06T06:59:03.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN62078684/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000127
CVE ID: CVE-2015-5625 State: PUBLISHED Published: 2015-09-07T14:00:00 Last Updated: 2024-08-06T06:59:03.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN00015036/index.html - http://www.opendocman.com/opendocman-v1-3-4-released/ - http://www.securitytracker.com/id/1033482 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000128
CVE ID: CVE-2015-5626 State: PUBLISHED Published: 2020-02-05T18:46:05 Last Updated: 2024-08-06T06:59:02.787Z Vendors: Yokogawa Products: CENTUM CS 1000, CENTUM CS 3000, CENTUM CS 3000 Entry, CENTUM VP, CENTUM VP Entry, ProSafe-RS, Exaopc, Exaquantum, Exaquantum/Batch, Exapilot, Exaplog, Exasmoc, Exarqe, Field Wireless Device OPC Server, PRM, STARDOM VDS, STARDOM OPC Server for Windows, FAST/TOOLS, B/M9000CS, B/M9000 VP, FieldMate Problem Types: Buffer Overflow Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earl
nd earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to caus
00CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (network-communications outage) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 - http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf
CVE ID: CVE-2015-5627 State: PUBLISHED Published: 2020-02-05T18:45:58 Last Updated: 2024-08-06T06:59:02.714Z Vendors: Yokogawa Products: CENTUM CS 1000, CENTUM CS 3000, CENTUM CS 3000 Entry, CENTUM VP, CENTUM VP Entry, ProSafe-RS, Exaopc, Exaquantum, Exaquantum/Batch, Exapilot, Exaplog, Exasmoc, Exarqe, Field Wireless Device OPC Server, PRM, STARDOM VDS, STARDOM OPC Server for Windows, FAST/TOOLS, B/M9000CS, B/M9000 VP, FieldMate Problem Types: Buffer Overflow Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earl
00CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 - http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf
CVE ID: CVE-2015-5628 State: PUBLISHED Published: 2020-02-05T18:46:01 Last Updated: 2024-08-06T06:59:02.677Z Vendors: Yokogawa Products: CENTUM CS 1000, CENTUM CS 3000, CENTUM CS 3000 Entry, CENTUM VP, CENTUM VP Entry, ProSafe-RS, Exaopc, Exaquantum, Exaquantum/Batch, Exapilot, Exaplog, Exasmoc, Exarqe, Field Wireless Device OPC Server, PRM, STARDOM VDS, STARDOM OPC Server for Windows, FAST/TOOLS, B/M9000CS, B/M9000 VP, FieldMate Problem Types: Buffer Overflow Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earl
nd earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to exec
00CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 - http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf
CVE ID: CVE-2015-5629 State: PUBLISHED Published: 2015-09-11T21:00:00 Last Updated: 2024-08-06T06:59:02.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN04644117/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000115 - https://itunes.apple.com/en/app/japan-connected-free-wi-fi/id810838196?mt=8 - https://play.google.com/store/apps/details?id=com.nttbp.jfw
CVE ID: CVE-2015-5630 State: PUBLISHED Published: 2015-09-11T21:00:00 Last Updated: 2024-08-06T06:59:03.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN41048401/index.html - https://itunes.apple.com/en/app/japan-connected-free-wi-fi/id810838196?mt=8 - https://play.google.com/store/apps/details?id=com.nttbp.jfw - http://jvndb.jvn.jp/jvndb/JVN
ree-wi-fi/id810838196?mt=8 - https://play.google.com/store/apps/details?id=com.nttbp.jfw - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000116
CVE ID: CVE-2015-5631 State: PUBLISHED Published: 2015-09-11T16:00:00 Last Updated: 2024-08-06T06:59:03.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authentication of administrators. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN07427376/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000129 - http://www.canon.com/support/pdf/inkjet-printer.pdf
CVE ID: CVE-2015-5632 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:03.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN73346595/995707/index.html - http://jvn.jp/en/jp/JVN73346595/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000130
CVE ID: CVE-2015-5633 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:04.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN71815309/index.html - http://jvn.jp/en/jp/JVN71815309/995707/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000131
CVE ID: CVE-2015-5634 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:03.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN83862346/995707/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000132 - http://jvn.jp/en/jp/JVN83862346/index.html
CVE ID: CVE-2015-5635 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:03.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN24517322/995707/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000133 - http://jvn.jp/en/jp/JVN24517322/index.html
CVE ID: CVE-2015-5636 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:03.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000134 - http://jvn.jp/en/jp/JVN67586379/index.html - http://jvn.jp/en/jp/JVN67586379/995707/index.html
CVE ID: CVE-2015-5637 State: PUBLISHED Published: 2015-09-20T17:00:00 Last Updated: 2024-08-06T06:59:03.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN19948778/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000135 - http://jvn.jp/en/jp/JVN19948778/995707/index.html
CVE ID: CVE-2015-5638 State: PUBLISHED Published: 2015-09-20T14:00:00 Last Updated: 2024-08-06T06:59:04.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000136 - http://jvn.jp/en/jp/JVN65602714/index.html - https://h2o.examp1e.net/vulnerabilities.html#CVE-2015-5638
CVE ID: CVE-2015-5639 State: PUBLISHED Published: 2017-10-10T16:00:00 Last Updated: 2024-08-06T06:59:04.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN20355129/index.html - http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000137.html - http://blog.nicovideo.jp/niconews/ni055746.html - http://www.securityfocus.com/bid/76906
CVE ID: CVE-2015-5640 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:03.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://basercms.net/security/JVN04855224 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000138 - http://jvn.jp/en/jp/JVN04855224/index.html
CVE ID: CVE-2015-5641 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:03.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN79633796/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000139 - http://basercms.net/security/JVN79633796
CVE ID: CVE-2015-5642 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:03.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000143 - http://jvn.jp/en/jp/JVN18232032/index.html - http://oss.icz.co.jp/news/?p=1073
CVE ID: CVE-2015-5643 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:04.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN66984217/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000144 - http://oss.icz.co.jp/news/?p=1073