Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-1991 State: REJECTED Published: 2018-07-16T15:00:00 Last Updated: 2018-07-16T14:57:01 Description: No description available.
CVE ID: CVE-2015-1992 State: PUBLISHED Published: 2015-08-23T14:00:00 Last Updated: 2024-08-06T05:02:42.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, which allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IT08185 - http://www-01.ibm.com/support/docview.wss?uid=nas7d9a0db411a9071e986257e8c0029b365 - http://www.securitytracker.com/id/1033653 - http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-509852
365 - http://www.securitytracker.com/id/1033653 - http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098524
CVE ID: CVE-2015-1993 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:43.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21968270
CVE ID: CVE-2015-1994 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:42.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21968271
CVE ID: CVE-2015-1995 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:43.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21968326
CVE ID: CVE-2015-1996 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:43.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21970139
CVE ID: CVE-2015-1997 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:43.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21970140
CVE ID: CVE-2015-1999 State: PUBLISHED Published: 2015-11-08T22:00:00 Last Updated: 2024-08-06T05:02:43.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21968269
CVE ID: CVE-2015-20001 State: PUBLISHED Published: 2021-04-11T19:06:53 Last Updated: 2024-08-06T08:58:26.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang/rust/issues/25842 - https://github.com/rust-lang/rust/pull/25856
CVE ID: CVE-2015-20002 State: REJECTED Published: N/A Last Updated: 2023-09-14T18:40:59.172Z Description: No description available.
CVE ID: CVE-2015-20019 State: PUBLISHED Published: 2021-11-01T08:45:49 Last Updated: 2024-08-06T08:58:26.464Z Vendors: Unknown Products: Content text slider on post Problem Types: CWE-79 Description: The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2015/Dec/124 - https://wpscan.com/vulnerability/4f92b211-e09c-4ed0-bc98-27e0b51b1f86 - https://plugins.trac.wordpress.org/changeset/1393044/content-text-slider-on-post
CVE ID: CVE-2015-20067 State: PUBLISHED Published: 2021-11-01T08:45:50 Last Updated: 2024-08-06T08:58:26.423Z Vendors: Unknown Products: WP Attachment Export Problem Types: CWE-862 Description: The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2015/Jul/73 - https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb - https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f3
iliary/scanner/http/wp_attachment_export_file_download.rb - https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a
CVE ID: CVE-2015-20105 State: PUBLISHED Published: 2021-12-02T17:40:10 Last Updated: 2024-08-06T08:58:26.450Z Vendors: Unknown Products: ClickBank Affiliate Ads Problem Types: CWE-79, CWE-352 Description: The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2bc3af7e-5542-40c4-8141-7c49e8df68f0 - https://seclists.org/bugtraq/2015/May/45 - https://p
s://wpscan.com/vulnerability/2bc3af7e-5542-40c4-8141-7c49e8df68f0 - https://seclists.org/bugtraq/2015/May/45 - https://packetstormsecurity.com/files/131814/
CVE ID: CVE-2015-20106 State: PUBLISHED Published: 2021-12-02T17:40:11 Last Updated: 2024-08-06T08:58:26.478Z Vendors: Unknown Products: ClickBank Affiliate Ads Problem Types: CWE-79 Description: The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/907792c4-3384-4351-bb75-0ad10f65fbe1
CVE ID: CVE-2015-20107 State: PUBLISHED Published: 2022-04-13T00:00:00.000Z Last Updated: 2025-11-03T21:43:59.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue24778 - https://github.com/python/cpython/issues/68966 - https
ram Container: References: - https://bugs.python.org/issue24778 - https://github.com/python/cpython/issues/68966 - https://security.netapp.com/advisory/ntap-20220616-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
NHM6J22O6Q5ANOE3SZRK3OACKR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/ - https
raproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/ - https://lists.fedoraproject.org/archives/list/package
ists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/ - https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html - https://security.gentoo.org/glsa/202305-02 - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE ID: CVE-2015-20108 State: PUBLISHED Published: 2023-05-27T00:00:00 Last Updated: 2025-01-14T18:39:03.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SAML-Toolkits/ruby-saml/pull/225 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml - https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0 - https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62a
uby-saml/compare/v0.9.2...v1.0.0 - https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448 - https://security.netapp.com/advisory/ntap-20230703-0003/
CVE ID: CVE-2015-20109 State: PUBLISHED Published: 2023-06-25T00:00:00 Last Updated: 2024-11-27T19:50:15.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/
issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=18036 - https://security.netapp.com/advisory/ntap-20230731-0009/
CVE ID: CVE-2015-20110 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T18:28:17.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhipster/generator-jhi
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhipster/generator-jhipster/issues/2095 - https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25 - https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc - https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0
CVE ID: CVE-2015-20111 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T16:35:31.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose_upnp_rce/ - http
n.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/07/03/disclose_upnp_rce/ - https://github.com/miniupnp/miniupnp/pull/157 - https://github.com/miniupnp/miniupnp/commit/4c90b87ce3d2517097880279e8c3daa7731100e6
CVE ID: CVE-2015-20112 State: PUBLISHED Published: 2025-06-29T00:00:00.000Z Last Updated: 2025-06-30T15:44:44.955Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Ethereum Products: RLPx Problem Types: CWE-325 Description: RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hyperledger/besu/issues/7926 - https://github.com/ethereum/go-ethereum/issues/1315 - https://github.com/ethereum/devp2p/blob/master/rlpx.md#known-issues-in-the-current-version - https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1b
/master/rlpx.md#known-issues-in-the-current-version - https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1bcf5761478f852398365901 - https://github.com/ethereum/devp2p/issues/32
CVE ID: CVE-2015-2000 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:42.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf - https://alephsecurity.com/vulns/aleph-2015001
CVE ID: CVE-2015-2001 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:43.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf - https://alephsecurity.com/vulns/aleph-2015002
CVE ID: CVE-2015-2002 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:42.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf - https://alephsecurity.com/vulns/aleph-2015003
CVE ID: CVE-2015-2003 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:42.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf - https://alephsecurity.com/vulns/aleph-2015004
CVE ID: CVE-2015-2004 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:42.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf - https://alephsecurity.com/vulns/aleph-2015005
CVE ID: CVE-2015-2005 State: PUBLISHED Published: 2016-02-15T02:00:00 Last Updated: 2024-08-06T05:02:43.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21967654
CVE ID: CVE-2015-2007 State: PUBLISHED Published: 2016-01-03T00:00:00 Last Updated: 2024-08-06T05:02:42.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21967647
CVE ID: CVE-2015-2008 State: PUBLISHED Published: 2016-02-15T02:00:00 Last Updated: 2024-08-06T05:02:43.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21967632
CVE ID: CVE-2015-2009 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-06T05:02:43.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21965821
CVE ID: CVE-2015-2010 State: REJECTED Published: 2015-02-20T17:00:00 Last Updated: 2015-02-20T17:57:00 Description: No description available.
CVE ID: CVE-2015-2011 State: PUBLISHED Published: 2015-10-04T01:00:00 Last Updated: 2024-08-06T05:02:42.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21965817
CVE ID: CVE-2015-2012 State: PUBLISHED Published: 2016-02-08T16:00:00 Last Updated: 2024-08-06T05:02:43.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IT09866 - http://www-01.ibm.com/support/docview.wss?uid=swg21968399 - http://www.securitytracker.com/id/1034943
CVE ID: CVE-2015-2013 State: PUBLISHED Published: 2015-09-14T01:00:00 Last Updated: 2024-08-06T05:02:43.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033449 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV73860 - http://www-01.ibm.com/support/docview.wss?uid=swg21962479