Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-8085 State: PUBLISHED Published: 2016-10-03T21:00:00 Last Updated: 2024-08-06T08:13:30.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 make it easier for remote authenticated administrators to obtain and decrypt passwords by leveraging selection of a reversible encryption algorithm. Additional Analyst Notes: - CVE Program Container: References: - http://www.securit
f a reversible encryption algorithm. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76897 - http://www.huawei.com/en/psirt/security-advisories/hw-455876
CVE ID: CVE-2015-8086 State: PUBLISHED Published: 2016-10-03T21:00:00 Last Updated: 2024-08-06T08:13:30.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus
ectors related to key storage. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76897 - http://www.huawei.com/en/psirt/security-advisories/hw-455876
CVE ID: CVE-2015-8087 State: PUBLISHED Published: 2015-11-19T20:00:00 Last Updated: 2024-08-06T08:13:31.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457933.htm
CVE ID: CVE-2015-8088 State: PUBLISHED Published: 2016-01-12T19:00:00 Last Updated: 2024-08-06T08:13:30.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application. Addit
00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77560 - http://www.huawei.com/en/psirt/security-advisories/hw-460347
CVE ID: CVE-2015-8089 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-06T08:13:30.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations and consequently cause a denial of service (system crash) or gain privileges via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-460276.htm
CVE ID: CVE-2015-8090 State: PUBLISHED Published: 2015-11-18T21:00:00 Last Updated: 2024-08-06T08:13:31.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain sensitive information, via an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/assets/bltec3263ae44ae601b/2015-005-advisory.txt - http://www.tibco.com/mk/advisory.jsp
CVE ID: CVE-2015-8091 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8094 State: PUBLISHED Published: 2018-05-22T18:00:00 Last Updated: 2024-08-06T08:13:31.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter. Additional Analyst Notes: - CVE Program Container: References: - https://issues.cloudera.org/browse/HUE-3626 - http://cloudera.github.io/hue/latest/release-notes/release-notes-3.10.0.html - https://github.com/cloudera/hue/pull/346 - https://www.harmfultrust.com/p/advisories.html
CVE ID: CVE-2015-8095 State: PUBLISHED Published: 2015-11-09T16:00:00Z Last Updated: 2024-09-16T23:06:27.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2608414 - https://www.drupal.org/node/2608382
CVE ID: CVE-2015-8096 State: PUBLISHED Published: 2015-11-09T16:00:00 Last Updated: 2024-08-06T08:13:31.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to "phase one 0x412 tag," which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2015-3/ - http://www.securityfocus.com/archive/1/536761/100/0/threaded - http://packetstormsecurity.com/files/134084/Google-Picasa-Phase-One-Tags-Processing-Integer-Overflow.html
CVE ID: CVE-2015-8098 State: PUBLISHED Published: 2016-01-12T19:00:00 Last Updated: 2024-08-06T08:13:30.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034609 - https://support.f5.com/kb/en-us/solutions/public/k/43/sol4355
References: - http://www.securitytracker.com/id/1034609 - https://support.f5.com/kb/en-us/solutions/public/k/43/sol43552605.html
CVE ID: CVE-2015-8099 State: PUBLISHED Published: 2016-05-13T16:00:00 Last Updated: 2024-08-06T08:13:31.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP DNS 12.x before 12.0.0 HF1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0; BIG-IP GTM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 HF10; Enterprise Manager
F10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 HF10; Enterprise Manager 3.0.0 through 3.1.1; BIG-IQ Cloud and BIG-IQ Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 on the 3900, 6900, 8900, 8950, 11000, 11050, PB100 and PB200 platforms, when software SYN cookies are configured on virtual servers, allow remote attackers to cause a denial of service (High-Speed Bridge hang) via an invalid TCP segment. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035873 - https://support.f5.com/kb/
yst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035873 - https://support.f5.com/kb/en-us/solutions/public/k/35/sol35358312.html - http://www.securitytracker.com/id/1035874
CVE ID: CVE-2015-8100 State: PUBLISHED Published: 2015-11-10T02:00:00 Last Updated: 2024-08-06T08:13:31.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: The net-snmp package in OpenBSD through 5.8 uses 0644 permissions for snmpd.conf, which allows local users to obtain sensitive community information by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/11/09/6 - http://packetstormsecurity.com/files/134323/OpenBSD-net-snmp-Information-Disclosure.html - http://www.securitytracker.com/id/1034099
CVE ID: CVE-2015-8103 State: PUBLISHED Published: 2015-11-25T20:00:00 Last Updated: 2024-08-06T08:13:31.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'". Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html - https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cl
-Deserialization.html - https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli - http://www.openwall.com/lists/oss-security/2015/11/18/13 - http://rhn.redhat.com/errata/RHSA-2016-0489.html - http://www.securityfocus.com/bid/77636 - http://www.openwall.com/lists/oss-security/2015/11/18/11 - https://access.redhat.com/errata/RHSA-2016:0070 - https://www.exploit-db.com/exploits/38983/ - http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins - http://www.openwall.com/lists/oss-security/2015/11/09/5 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Securi
- http://www.openwall.com/lists/oss-security/2015/11/09/5 - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 - http://www.openwall.com/lists/oss-security/2015/11/18/2
CVE ID: CVE-2015-8104 State: PUBLISHED Published: 2015-11-16T00:00:00.000Z Last Updated: 2025-04-23T15:40:54.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://rhn.redhat.com/errata/RHSA-2015-2636.html - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.ubuntu.com/usn/USN-2841-2 - http://lists.fedoraproject.org/pipermail/
urity/ovmbulletinjul2016-3090546.html - http://www.ubuntu.com/usn/USN-2841-2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172187.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html - https://kb.juniper.net/JSA10783 - https://bugzilla.redhat.com/show_bug.cgi?id=1278496 - http://www.debian.org/security/2016/dsa-3454 - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://rhn.redhat.com/errata/RHSA-2015-2645.html - http://www.ubuntu.com/usn/USN-2840-1 - http://www.securityfocus.com/bid/77524 - https://github.com/torvalds/linux/commit/cbdb967af3d54993f5814f1cee0ed311a055377d - http://lists.opensuse.org/open
524 - https://github.com/torvalds/linux/commit/cbdb967af3d54993f5814f1cee0ed311a055377d - http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.openwall.com/lists/oss-security/2015/11/10/5 - http://www.ubuntu.com/usn/USN-2843-1 - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - http://www.ubuntu.com/usn/USN-2844-1 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.html - http://www.ubuntu.com/usn/USN-2842-2 - http://xenbits.xen.org/xsa/advisory-156.html - http://lists.op
12/msg00039.html - http://www.ubuntu.com/usn/USN-2842-2 - http://xenbits.xen.org/xsa/advisory-156.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html - http://www.ubuntu.com/usn/USN-2843-2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172300.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.ubuntu.com/usn/USN-2842-1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172435.html - http://www.debian.org/securi
2-1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172435.html - http://www.debian.org/security/2015/dsa-3414 - http://support.citrix.com/article/CTX202583 - http://www.securitytracker.com/id/1034105 - http://www.securityfocus.com/bid/91787 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://www.ubuntu.com/usn/USN-2841-1 - http://support.citrix.com/article/CTX203879 - http://www.debian.org/security/2015/dsa-3426 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cbdb967af3d54993f5814f1cee0ed311a055377d - http://rhn.redhat.com/errata/RHSA-2016-0046.html - http://lists.opensuse.org/opensuse-security-announce/
ed311a055377d - http://rhn.redhat.com/errata/RHSA-2016-0046.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html - http://www.openwall.com/lists/oss-security/2023/10/10/4
CVE ID: CVE-2015-8105 State: PUBLISHED Published: 2015-11-10T16:00:00 Last Updated: 2024-08-06T08:13:30.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201603-03 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html - http://trac.roundcube.net/changeset/dd7db2179/github - http://trac.roundcube.net/ticket/1490530
CVE ID: CVE-2015-8106 State: PUBLISHED Published: 2016-04-18T14:00:00 Last Updated: 2024-08-06T08:13:31.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/11/16/3 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181276.html - https://sourceforge.net/p/latex2rtf/code/1244/ - http://lists.fedoraproject.org/pipermail/package-announ
l/181276.html - https://sourceforge.net/p/latex2rtf/code/1244/ - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181677.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181725.html - https://bugzilla.redhat.com/show_bug.cgi?id=1282492
CVE ID: CVE-2015-8107 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T08:13:31.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77595 - http://seclists.org/oss-sec/2015/q4/284
CVE ID: CVE-2015-8108 State: PUBLISHED Published: 2016-04-08T16:00:00 Last Updated: 2024-08-06T08:13:30.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, px4-400r, and px4-300d NAS devices with firmware before 4.1.204.33661 allows remote attackers to obtain sensitive device information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/len_3846
CVE ID: CVE-2015-8109 State: PUBLISHED Published: 2017-04-24T06:12:00 Last Updated: 2024-08-06T08:13:31.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX account credentials that requires knowledge of the time that this account was created, aka a "temporary administrator account vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98039 - https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_SystemUpdate-Insecure-Random-Admin-Password.pdf - https://support.lenovo.
s://ioactive.com/pdfs/IOActive_Advisory_Lenovo_SystemUpdate-Insecure-Random-Admin-Password.pdf - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-8110 State: PUBLISHED Published: 2017-04-24T06:12:00 Last Updated: 2024-08-06T08:13:30.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98037 - https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf -
securityfocus.com/bid/98037 - https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf - https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE ID: CVE-2015-8113 State: PUBLISHED Published: 2015-11-12T02:00:00 Last Updated: 2024-08-06T08:13:31.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492. Additional Analyst Notes: - CVE Program Container: References: - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00 - http://www.securityfocus.com/bid/77585
CVE ID: CVE-2015-8114 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8115 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8116 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8117 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8118 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8119 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8120 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8121 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8122 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8123 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2015-8124 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T08:13:31.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html - http://www.securityfocus.com/archive/1/537183/100/0/threaded - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html - http://www.debian.org/sec
readed - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html - http://www.debian.org/security/2015/dsa-3402 - http://www.securityfocus.com/bid/77694 - http://seclists.org/fulldisclosure/2015/Dec/89 - https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature
CVE ID: CVE-2015-8125 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T08:13:31.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Additional Ana
mfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html - http://www.debian.org/security/2015/dsa-3402 - https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service - http://www.securityfocus.com/bid/77692
CVE ID: CVE-2015-8126 State: PUBLISHED Published: 2015-11-13T02:00:00 Last Updated: 2024-08-06T08:13:31.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. Additional Analyst Notes: - CVE Program Container: References: - http://lists.apple.com/archives/security-announce/2016/Mar/m