Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3439 State: PUBLISHED Published: 2015-08-05T10:00:00 Last Updated: 2024-08-06T05:47:57.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. Additional Analyst Notes: - CVE Program Container: References: - http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html - htt
CVE Program Container: References: - http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html - https://wordpress.org/news/2015/04/wordpress-4-1-2/ - https://wpvulndb.com/vulnerabilities/7933 - http://www.securityfocus.com/bid/74269 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html - http://www.securitytracker.com/id/1032207 - https://core.trac.wordpress.org/changeset/32168 - http://www.debian.org/security/2015/dsa-3250 - http://codex.wordpress.org/Version_4.1.2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html
CVE ID: CVE-2015-3440 State: PUBLISHED Published: 2015-08-03T14:00:00 Last Updated: 2024-08-06T05:47:57.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/36844/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html - http://codex.wordpress.org/Version_4.2.1 - https://klikki.fi/adv/wordpress2.html - https:
nnounce/2015-May/157391.html - http://codex.wordpress.org/Version_4.2.1 - https://klikki.fi/adv/wordpress2.html - https://wpvulndb.com/vulnerabilities/7945 - https://wordpress.org/news/2015/04/wordpress-4-2-1/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html - http://www.securityfocus.com/bid/74334 - http://seclists.org/fulldisclosure/2015/Apr/84 - https://core.trac.wordpress.org/changeset/32299 - http://osvdb.org/show/osvdb/121320 - http://www.securitytracker.com/id/1032199 - http://www.debian.org/security/2015/dsa-3250 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html - http://packetstormsecurity.com/files/131644/WordPress-4.2-
project.org/pipermail/package-announce/2015-May/158271.html - http://packetstormsecurity.com/files/131644/WordPress-4.2-Cross-Site-Scripting.html
CVE ID: CVE-2015-3441 State: PUBLISHED Published: 2017-01-05T22:00:00 Last Updated: 2024-08-06T05:47:57.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Parental Control panel in Genexis devices with DRGOS before 1.14.1 allows remote authenticated users to execute arbitrary CLI commands via the (1) start_hour, (2) start_minute, (3) end_hour, (4) end_minute, or (5) hostname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95398 - https://www.navixia.com/CVE-2015-3441.txt
CVE ID: CVE-2015-3442 State: PUBLISHED Published: 2017-09-07T13:00:00 Last Updated: 2024-08-06T05:47:57.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2015-001_Authentication_Bypass_Xpert_Line.txt - http://seclists.org/fulldisclosure/2015/Jul/9 - http://www.securityfocus.com/bid/75542 - http://www.securityfocus.com/archive/1/535923/100/0/threaded - http://packetstormsecurity.com/files/132549/Soreco-AG-Xpert.Line-3.
.securityfocus.com/archive/1/535923/100/0/threaded - http://packetstormsecurity.com/files/132549/Soreco-AG-Xpert.Line-3.0-Authentication-Bypass.html
CVE ID: CVE-2015-3443 State: PUBLISHED Published: 2015-07-02T14:42:00 Last Updated: 2024-08-06T05:47:57.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/535821/100/0/threaded - http://www.securityfocus.com/bid/75393 - http://seclists.org/fulldisclosure/2015/Jun/78 - http://thycotic.com/prod
ded - http://www.securityfocus.com/bid/75393 - http://seclists.org/fulldisclosure/2015/Jun/78 - http://thycotic.com/products/secret-server/resources/advisories/thy-ss-004/ - http://www.csnc.ch/misc/files/advisories/CVE-2015-3443_Thycotic_Secret_Server_XSS.TXT - https://www.exploit-db.com/exploits/37394/
CVE ID: CVE-2015-3446 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:47:57.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg). Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-161/ - https://www.alienvault.com/forums/discussion/4415/ - http://www.securityfocus.com/bid/74403
CVE ID: CVE-2015-3447 State: PUBLISHED Published: 2015-04-29T20:00:00 Last Updated: 2024-08-06T05:47:57.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Apr/97 - http://www.securityfocus.com/archive/1/535393/100/0/threaded - http://www.securityfocus.com/bid/74406 - http://www.vulnerability-lab.com/get_content.php?id=1359 - http://www.secur
d - http://www.securityfocus.com/bid/74406 - http://www.vulnerability-lab.com/get_content.php?id=1359 - http://www.securitytracker.com/id/1032204
CVE ID: CVE-2015-3448 State: PUBLISHED Published: 2015-04-29T20:00:00 Last Updated: 2024-08-06T05:47:57.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74415 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00026.html - http://www.osvdb.org/117461 - https://github.com/rest-client/rest-client/issues/349
CVE ID: CVE-2015-3449 State: PUBLISHED Published: 2015-07-16T14:00:00 Last Updated: 2024-08-06T05:47:57.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jul/60 - http://packetstormsecurity.com/files/132681/SAP-Afaria-XeService.exe-7.0.6398.0-Weak-File-Permissions.html - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-34
e-Permissions.html - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-3449/ - http://www.securityfocus.com/bid/75725
CVE ID: CVE-2015-3450 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:47:57.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74375 - http://www.openwall.com/lists/oss-security/2015/04/29/7
CVE ID: CVE-2015-3451 State: PUBLISHED Published: 2015-05-12T19:00:00 Last Updated: 2024-08-06T05:47:57.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function. Additional Analyst Notes: - CVE Program Container: References: - http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes - http://www.openwall.com/lists/oss-security/2015/04/30/1 - https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/ - http
015/04/30/1 - https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/ - http://www.debian.org/security/2015/dsa-3243 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html - http://www.openwall.com/lists/oss-security/2015/04/25/2 - http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:231 - http://www.ubuntu.com/usn/USN-2592-1 - http://advisories.mageia.org/MGASA-2015-0199.html - http://www.securityfocus.com/bid/74333
CVE ID: CVE-2015-3454 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:47:57.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VulcanJS/Vulcan/issues/838 - http://www.openwall.com/lists/oss-security/2015/04/29/8 - http://www.securityfocus.com/bid/74331 - https://github.com/VulcanJS/Vulcan/commit/827a15dc7422b2447f3a2e395b5e511379002ea4
CVE ID: CVE-2015-3455 State: PUBLISHED Published: 2015-05-18T15:00:00 Last Updated: 2024-08-06T05:47:57.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html - http://rhn.redhat.com/errata/RHSA-2015-2378.html - http://www.oracle.com/technetwork
age-announce/2016-May/183598.html - http://rhn.redhat.com/errata/RHSA-2015-2378.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://lists.opensuse.org/opensuse-updates/2015-09/msg00016.html - http://www.securityfocus.com/bid/74438 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.securitytracker.com/id/1032221 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html - http://advisories.mageia.org/MGASA-2015-0191.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:230 - http://www.squid-cache.org/Advisories/SQUID-2015_1.txt
CVE ID: CVE-2015-3456 State: PUBLISHED Published: 2015-05-13T18:00:00 Last Updated: 2024-08-06T05:47:57.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/37053/ - http://www.securitytracker.com/id/1032306 - http://www.oracle.com/technetwork/topics/security/cpujul2
/exploits/37053/ - http://www.securitytracker.com/id/1032306 - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html - https://kb.juniper.net/JSA10783 - http://www.debian.org/security/2015/dsa-3259 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html - https://security.gentoo.org/glsa/201612-27 - http://rhn.redhat.com/errata/RHSA-2015-0999.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10118 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html - http://rhn.r
ndex?page=content&id=SB10118 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html - http://rhn.redhat.com/errata/RHSA-2015-1001.html - http://marc.info/?l=bugtraq&m=143229451215900&w=2 - http://support.citrix.com/article/CTX201078 - http://xenbits.xen.org/xsa/advisory-133.html - http://rhn.redhat.com/errata/RHSA-2015-1003.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html - http://www.securitytracker.com/id/1032917 - http://marc.info/?l=bugtraq&m=143387998230996&w=2 - http://rhn.redhat.com/errata/RHSA-2015-0998.html - https://www.suse.com/security/cve/CVE-2015-3456.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00
ttps://www.suse.com/security/cve/CVE-2015-3456.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html - https://bto.bluecoat.com/security-advisory/sa95 - http://rhn.redhat.com/errata/RHSA-2015-1004.html - http://venom.crowdstrike.com/ - http://rhn.redhat.com/errata/RHSA-2015-1011.html - https://support.lenovo.com/us/en/product_security/venom - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html - http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c - https://security.gentoo.org/glsa/201604-03 - http://rhn.redhat.com/errata/R
h=e907746266721f305d67bc0718795fedee2e824c - https://security.gentoo.org/glsa/201604-03 - http://rhn.redhat.com/errata/RHSA-2015-1002.html - http://www.ubuntu.com/usn/USN-2608-1 - https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693 - http://www.securitytracker.com/id/1032311 - http://marc.info/?l=bugtraq&m=143229451215900&w=2 - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm - http://www.debian.org/security/2015/dsa-3262 - https://security.gentoo.org/glsa/201602-01 - http://lists.opensuse.org
- http://www.debian.org/security/2015/dsa-3262 - https://security.gentoo.org/glsa/201602-01 - http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html - http://www.securityfocus.com/bid/74640 - http://www.debian.org/security/2015/dsa-3274 - http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability - https://access.redhat.com/articles/1444903 - http://rhn.redhat.com/errata/RHSA-2015-1000.html - https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10
CVE ID: CVE-2015-3457 State: PUBLISHED Published: 2015-04-29T22:00:00 Last Updated: 2024-08-06T05:47:57.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74420 - http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securitytracker.com/id/1032230 - http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
CVE ID: CVE-2015-3458 State: PUBLISHED Published: 2015-04-29T22:00:00 Last Updated: 2024-08-06T05:47:58.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. Additional Analyst Notes:
ge boundaries, since administrators might already have privileges to include arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securityfocus.com/bid/74412 - http://www.securitytracker.com/id/1032230 - http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
CVE ID: CVE-2015-3459 State: PUBLISHED Published: 2015-04-29T23:00:00 Last Updated: 2024-08-06T05:47:57.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 - http://imgur.com/JHiWSqd - http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm - https://twitter.com/dyngnosis/status/592671049487142913 - http://hextechsecurity.c
fety/AlertsandNotices/ucm446809.htm - https://twitter.com/dyngnosis/status/592671049487142913 - http://hextechsecurity.com/?p=123 - https://twitter.com/dyngnosis/status/592743461977219072 - http://imgur.com/CEAnZjj - http://www.securityfocus.com/bid/74414
CVE ID: CVE-2015-3569 State: REJECTED Published: 2016-04-26T10:00:00 Last Updated: 2016-04-26T01:57:02 Description: No description available.
CVE ID: CVE-2015-3571 State: REJECTED Published: 2016-04-26T10:00:00 Last Updated: 2016-04-26T01:57:02 Description: No description available.
CVE ID: CVE-2015-3572 State: REJECTED Published: 2016-04-26T10:00:00 Last Updated: 2016-04-26T01:57:02 Description: No description available.
CVE ID: CVE-2015-3591 State: REJECTED Published: 2016-02-25T11:00:00 Last Updated: 2016-02-25T04:57:01 Description: No description available.
CVE ID: CVE-2015-3610 State: PUBLISHED Published: 2015-05-07T10:00:00 Last Updated: 2024-08-06T05:47:57.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311412.pdf
CVE ID: CVE-2015-3611 State: PUBLISHED Published: 2020-02-04T19:14:52 Last Updated: 2024-08-06T05:47:57.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securityfocus.com/bid/74444 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3612 State: PUBLISHED Published: 2020-02-04T19:21:15 Last Updated: 2024-08-06T05:47:57.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securityfocus.com/bid/74444 - http://www.securitytracker.com/id/1032188 - https://fortiguard.com/psirt/FG-IR-15-011
CVE ID: CVE-2015-3613 State: PUBLISHED Published: 2020-02-04T19:28:28 Last Updated: 2024-08-06T05:47:57.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securityfocus.com/bid/74444 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3614 State: PUBLISHED Published: 2017-08-11T21:00:00 Last Updated: 2024-08-06T05:47:57.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74444 - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3615 State: PUBLISHED Published: 2017-08-11T21:00:00 Last Updated: 2024-08-06T05:47:57.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74444 - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3616 State: PUBLISHED Published: 2017-08-11T21:00:00 Last Updated: 2024-08-06T05:47:57.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74444 - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3617 State: PUBLISHED Published: 2017-08-22T15:00:00 Last Updated: 2024-08-06T05:47:58.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74444 - https://fortiguard.com/psirt/FG-IR-15-011 - http://www.securitytracker.com/id/1032188
CVE ID: CVE-2015-3618 State: PUBLISHED Published: 2018-02-06T16:00:00 Last Updated: 2024-08-06T05:47:57.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-15-011 - https://assets.nagios.com/downloads/exchange/nagiosbpi/CHANGELOG.txt