Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7313 State: PUBLISHED Published: 2017-03-17T14:00:00.000Z Last Updated: 2025-08-26T15:15:13.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76843 - https://security.gentoo.org/glsa/201701-16 - http://seclists.org/oss-sec/2015/q3/601 - https://bugzilla.redhat.com/show_bug.cgi?id=1265998 - https://security-tracker.debian.org/tracker/CVE-2015-7313 - https://ubuntu.com/security/CVE-2015-7313
CVE ID: CVE-2015-7314 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T07:43:46.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1 - http://jvn.jp/en/jp/JVN27548431/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149 - https://github.com/gollum/gollum/issues/1070 - http://www.openwall.com/lists/oss-security/2015/09/22/12
CVE ID: CVE-2015-7315 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T07:43:46.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1264791 - https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406 - http://www.openwall.com/lists/oss-security/2015/09/22/13
ducts.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406 - http://www.openwall.com/lists/oss-security/2015/09/22/13 - https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members
CVE ID: CVE-2015-7316 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T07:43:46.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/09/22/14 - https://bugzilla.redhat.com/show_bug.cgi?id=1264788 - https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 - https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone
CVE ID: CVE-2015-7317 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T07:43:46.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20150910/privilege-escalation-in-kupu - https://plone.org/security/hotfix/20150910 - https://bugzilla.redhat.com/show_bug.cgi?id=1264799 - http://www.openwall.com/lists/oss-security/2015/09/22/15
CVE ID: CVE-2015-7318 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-06T07:43:46.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20150910 - https://bugzilla.redhat.com/show_bug.cgi?id=1264796 - https://plone.org/security/hotfix/20150910/header-injection - http://www.openwall.com/lists/oss-security/2015/09/22/16
CVE ID: CVE-2015-7319 State: PUBLISHED Published: 2015-09-29T19:00:00 Last Updated: 2024-08-06T07:43:46.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/appointment-booking-calendar/changelog/ - https://wpvulndb.com/vulnerabilities/8199 - http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-
/wpvulndb.com/vulnerabilities/8199 - http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-1.1.7-SQL-Injection.html - http://www.securityfocus.com/archive/1/536555/100/0/threaded
CVE ID: CVE-2015-7320 State: PUBLISHED Published: 2015-09-29T19:00:00 Last Updated: 2024-08-06T07:43:46.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/appointment-booking-calendar/changelog/ - http://packetstormsecurity.com/files/133743/WordPress-Appointment-Booking-Calendar-1.1.7-XSS.html - https://wpvulndb.com/vulnerabili
tstormsecurity.com/files/133743/WordPress-Appointment-Booking-Calendar-1.1.7-XSS.html - https://wpvulndb.com/vulnerabilities/8199 - http://www.securityfocus.com/archive/1/536556/100/0/threaded - http://www.securityfocus.com/archive/1/536557/100/0/threaded
CVE ID: CVE-2015-7322 State: PUBLISHED Published: 2015-10-05T15:00:00 Last Updated: 2024-08-06T07:43:46.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033685 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40053 - https:/
p://www.securitytracker.com/id/1033685 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40053 - https://profundis-labs.com/advisories/CVE-2015-7322.txt
CVE ID: CVE-2015-7323 State: PUBLISHED Published: 2015-10-05T15:00:00 Last Updated: 2024-08-06T07:43:46.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40054 - https://profundis-labs.com/advisories/CVE-2015-7323.txt - http://www.securitytrack
s/Pulse_Security_Advisories/SA40054 - https://profundis-labs.com/advisories/CVE-2015-7323.txt - http://www.securitytracker.com/id/1033684 - http://seclists.org/fulldisclosure/2015/Sep/98 - https://packetstormsecurity.com/files/133711/Junos-Pulse-Secure-Meeting-8.0.5-Access-Bypass.html
CVE ID: CVE-2015-7324 State: PUBLISHED Published: 2017-12-27T19:00:00 Last Updated: 2024-08-06T07:43:46.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment. Additional Analyst Notes: - CVE Program Container: References: - https://stackideas.com/changelog/komento?version=2.0.5 - https://www.davidsopas.com/komento-joomla-component-persistent-xss/ - http://seclists.org/fulldisclosure/2015/Oct/11
CVE ID: CVE-2015-7326 State: PUBLISHED Published: 2017-06-07T14:00:00 Last Updated: 2024-08-06T07:43:46.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miltonio/milton2/commit/b5851c1 - https://github.com/miltonio/milton2/commit/5f81b0c48a817d4337d8b0e99ea0b4744ecd720b - http://www.securityfocus.com/archive/1/536813/100/0/threaded - http://www.securityfocus.com/bid/77392 - http://packetstormsecurity.com/files/134178/Milton-Webdav-2.7.0.1-XXE-Injection.html - https://github.com/miltonio/milton2/commit/b41072b
CVE ID: CVE-2015-7327 State: PUBLISHED Published: 2015-09-24T01:00:00 Last Updated: 2024-08-06T07:43:46.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls. Additional Analyst Notes: - CVE Program Container: References: - http://arxiv.org/abs/1502.07373 - http://www.securitytracker.com/id/1033640 - https://bugzilla.mozilla.org/show_bug.cgi?id=1167489 - http://www.mozilla.org/security/announce/2015/mfsa2015
/1033640 - https://bugzilla.mozilla.org/show_bug.cgi?id=1167489 - http://www.mozilla.org/security/announce/2015/mfsa2015-114.html - https://bugzilla.mozilla.org/show_bug.cgi?id=1153672
CVE ID: CVE-2015-7328 State: PUBLISHED Published: 2016-01-08T19:00:00 Last Updated: 2024-08-06T07:43:46.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://puppetlabs.com/security/cve/cve-2015-7328
CVE ID: CVE-2015-7330 State: PUBLISHED Published: 2016-04-11T21:00:00 Last Updated: 2024-08-06T07:43:46.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol. Additional Analyst Notes: - CVE Program Container: References: - https://puppetlabs.com/security/cve/cve-2015-7330 - http://www.securitytracker.com/id/1034550
CVE ID: CVE-2015-7331 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-06T07:43:46.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2015-7331 - http://www.securityfocus.com/bid/92432
CVE ID: CVE-2015-7333 State: PUBLISHED Published: 2020-03-27T14:05:01 Last Updated: 2024-08-06T07:43:46.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-7334 State: PUBLISHED Published: 2020-03-27T14:05:01 Last Updated: 2024-08-06T07:43:46.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-7335 State: PUBLISHED Published: 2020-03-27T14:05:01 Last Updated: 2024-08-06T07:43:46.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-7336 State: PUBLISHED Published: 2020-03-27T14:05:01 Last Updated: 2024-08-06T07:43:46.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-7337 State: PUBLISHED Published: 2015-09-29T19:00:00 Last Updated: 2024-08-06T07:43:46.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201512-02 - https://bugzilla.redhat.com/show_bug.cgi?id=1264067 - http://seclists.org/oss-sec/2015/q3/558 - https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967 - https://github.c
-sec/2015/q3/558 - https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967 - https://github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5 - http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html - http://seclists.org/oss-sec/2015/q3/634
CVE ID: CVE-2015-7338 State: PUBLISHED Published: 2020-03-09T16:24:28 Last Updated: 2024-08-06T07:43:46.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7338/
CVE ID: CVE-2015-7339 State: PUBLISHED Published: 2020-03-09T16:23:05 Last Updated: 2024-08-06T07:43:46.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7339/
CVE ID: CVE-2015-7340 State: PUBLISHED Published: 2020-03-09T16:21:22 Last Updated: 2024-08-06T07:43:46.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7340/
CVE ID: CVE-2015-7341 State: PUBLISHED Published: 2020-03-09T16:17:07 Last Updated: 2024-08-06T07:43:46.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7341/
CVE ID: CVE-2015-7342 State: PUBLISHED Published: 2020-03-09T16:16:01 Last Updated: 2024-08-06T07:43:46.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7342/
CVE ID: CVE-2015-7343 State: PUBLISHED Published: 2020-03-09T13:39:27 Last Updated: 2024-08-06T07:43:46.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7343/
CVE ID: CVE-2015-7344 State: PUBLISHED Published: 2020-03-09T13:35:36 Last Updated: 2024-08-06T07:43:46.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption]. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2015-7344/
CVE ID: CVE-2015-7346 State: PUBLISHED Published: 2017-06-07T21:00:00 Last Updated: 2024-08-06T07:43:46.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ZCMS 1.1. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt - http://packetstormsecurity.com/files/132286/ZCMS-1.1-Cross-Site-Scripting-SQL-Injection.html - https://www.exploit-db.com/exploits/37272/
CVE ID: CVE-2015-7347 State: PUBLISHED Published: 2017-09-20T18:00:00 Last Updated: 2024-08-06T07:43:46.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132286/ZCMS-1.1-Cross-Site-Scripting-SQL-Injection.html - https://www.exploit-db.com/exploits/37272/
CVE ID: CVE-2015-7348 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T07:43:46.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134391/zTree-3.5.19.1-Cross-Site-Scripting.html - https://github.com/zTree/zTree_v3/commit/b8fb6551e9b970ad37134af0562ffabe24a7672d - http://seclists.org/fulldisclosure/2015/Nov/80
CVE ID: CVE-2015-7349 State: PUBLISHED Published: 2017-09-27T19:00:00 Last Updated: 2024-08-06T07:43:46.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.vasco.com/support/knowledge-base-articles/kb-140148.html - https://www.vasco.com/images/de-de/KB_140148_tcm45-47825.pdf - https://labs.integrity.pt/advisories/cve-2015-7349/index.html
CVE ID: CVE-2015-7357 State: PUBLISHED Published: 2017-10-02T19:00:00 Last Updated: 2024-08-06T07:43:46.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133867/WordPress-U-Design-Theme-2.7.9-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2015/Oct/25 - http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 -
http://seclists.org/fulldisclosure/2015/Oct/25 - http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 - https://wpvulndb.com/vulnerabilities/8177
CVE ID: CVE-2015-7358 State: PUBLISHED Published: 2017-10-02T19:00:00 Last Updated: 2024-08-06T07:43:46.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory. Additional Analyst Notes: - CVE Program Container: References: - https://veracrypt.codeplex.com/wikipage?title=Release%20Notes - https://www.exploit-db.com/exploits/38403/ - http://www.openwall.
eracrypt.codeplex.com/wikipage?title=Release%20Notes - https://www.exploit-db.com/exploits/38403/ - http://www.openwall.com/lists/oss-security/2015/09/24/3 - http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.html - http://www.openwall.com/lists/oss-security/2015/09/22/7 - https://code.google.com/p/google-security-research/issues/detail?id=538
CVE ID: CVE-2015-7359 State: PUBLISHED Published: 2017-10-02T19:00:00 Last Updated: 2024-08-06T07:43:46.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes. Additional Analyst Notes: - CVE Program Container: References: - https://code.google.com/p/google-security-research/issues/detail?id=537 - https://veracrypt.codeplex.com/wiki
erences: - https://code.google.com/p/google-security-research/issues/detail?id=537 - https://veracrypt.codeplex.com/wikipage?title=Release%20Notes - http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html - http://www.openwall.com/lists/oss-security/2015/09/24/3 - http://www.openwall.com/lists/oss-security/2015/09/22/7
CVE ID: CVE-2015-7360 State: PUBLISHED Published: 2016-05-26T15:00:00 Last Updated: 2024-08-06T07:43:46.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature." Additional Analyst Note
by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/536124/100/0/threaded - http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt - http://fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortisandbox-webui - http://packetstormsecurity.com/files/132930/FortiSandbox-3000D-2.02-build0042-Cross-Site-Scripting.html