Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-5644 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:03.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN08535069/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000145 - http://oss.icz.co.jp/news/?p=1075
CVE ID: CVE-2015-5645 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:04.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN85118545/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000146 - http://oss.icz.co.jp/news/?p=1075
CVE ID: CVE-2015-5646 State: PUBLISHED Published: 2015-10-12T10:00:00 Last Updated: 2024-08-06T06:59:04.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867. Additional Analyst Notes: - CVE Program Container: References: - https://support.cybozu.com/ja-jp/article/8811 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000151 - http://jvn.jp/en/jp/JVN21025396/index.html - http://jvn.jp/en/jp/JVN21025396/374951/index.html - https://support.cybozu.com/ja-jp/article/8809
CVE ID: CVE-2015-5647 State: PUBLISHED Published: 2015-10-12T10:00:00 Last Updated: 2024-08-06T06:59:04.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000151 - https://support.cybozu.com/ja-jp/article/8810 - http://jvn.jp/en/jp/JVN21025396/index.html - http://jvn.jp/en/jp/JVN21025396/374951/index.html
CVE ID: CVE-2015-5648 State: PUBLISHED Published: 2015-10-11T01:00:00 Last Updated: 2024-08-06T06:59:03.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in list.php in phpRechnung before 1.6.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN02671769/index.html - https://mail.loenshotel.de/phpRechnung/ChangeLog.php - http://sourceforge.net/projects/phprechnung/files/phpRechnung/1.6.5/phpRechnung_1_6_5.tar.bz2/download - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000154
CVE ID: CVE-2015-5649 State: PUBLISHED Published: 2015-10-08T20:00:00 Last Updated: 2024-08-06T06:59:03.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN38369032/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152 - https://support.cybozu.com/ja-jp/article/9176
CVE ID: CVE-2015-5650 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T06:59:03.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN27462572/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000147
CVE ID: CVE-2015-5651 State: PUBLISHED Published: 2015-10-03T22:00:00 Last Updated: 2024-08-06T06:59:04.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN65668004/index.html - http://dotclear.org/blog/post/2015/09/23/Dotclear-2.8.1 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000148
CVE ID: CVE-2015-5652 State: PUBLISHED Published: 2015-10-05T10:00:00 Last Updated: 2024-08-06T06:59:03.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point." Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000141 - http://www.securityfocus.com/bid/76929 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/d
db/JVNDB-2015-000141 - http://www.securityfocus.com/bid/76929 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 - http://jvn.jp/en/jp/JVN49503705/995204/index.html - http://jvn.jp/en/jp/JVN49503705/index.html
CVE ID: CVE-2015-5653 State: PUBLISHED Published: 2015-10-02T15:00:00 Last Updated: 2024-08-06T06:59:03.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000140 - http://jvn.jp/en/jp/JVN07676450/index.html
CVE ID: CVE-2015-5654 State: PUBLISHED Published: 2015-10-11T01:00:00 Last Updated: 2024-08-06T06:59:03.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77026 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000153 - http://jvn.jp/en/jp/JVN13456571/index.html - http://www-01.ibm.com/support/docview.wss?uid=swg21975256 - http://www.securitytracker.com/id/1034848
CVE ID: CVE-2015-5655 State: PUBLISHED Published: 2015-11-10T02:00:00 Last Updated: 2024-08-06T06:59:03.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN48211537/995687/index.html - http://jvn.jp/en/jp/JVN48211537/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000159
CVE ID: CVE-2015-5656 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-5657 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-5658 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-5659 State: PUBLISHED Published: 2015-10-11T01:00:00 Last Updated: 2024-08-06T06:59:04.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NaCl-Ltd/pref-shimane-cms/commit/ab96ec7661f15a0129940eed9215c91f1acbf564 - http://jvn.jp/en/jp/JVN84982142/995760/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000158 - http://jvn.jp/en/jp/JVN84982142/index.html - https://github.com/NaCl-Ltd/pr
ttp://jvndb.jvn.jp/jvndb/JVNDB-2015-000158 - http://jvn.jp/en/jp/JVN84982142/index.html - https://github.com/NaCl-Ltd/pref-shimane-cms/commit/5ec03cb174513844c410ee7fba594c544ba80ce2 - https://github.com/NaCl-Ltd/pref-shimane-cms/blob/master/README.md
CVE ID: CVE-2015-5660 State: PUBLISHED Published: 2015-10-16T01:00:00 Last Updated: 2024-08-06T06:59:03.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://extplorer.net/news/18 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000126 - http://jvn.jp/en/jp/JVN92520335/index.html
CVE ID: CVE-2015-5661 State: PUBLISHED Published: 2015-10-18T19:00:00 Last Updated: 2024-08-06T06:59:04.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN37825153/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000162
CVE ID: CVE-2015-5662 State: PUBLISHED Published: 2015-10-18T10:00:00 Last Updated: 2024-08-06T06:59:03.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000160 - http://www.securitytracker.com/id/1033860 - http://jvn.jp/en/jp/JVN25576608/index.html
CVE ID: CVE-2015-5663 State: PUBLISHED Published: 2015-12-30T02:00:00 Last Updated: 2024-08-06T06:59:03.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that was selected by the user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/79666 - http://jvn.jp/en/jp/JVN64636058/index.html - http://www.securitytracker.com/id/1034881 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000199
CVE ID: CVE-2015-5664 State: PUBLISHED Published: 2016-07-03T14:00:00 Last Updated: 2024-08-06T06:59:03.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/i/en/support/con_show.php?cid=93 - http://jvn.jp/en/jp/JVN42930233/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000119 - http://www.securitytracker.com/id/1036123
CVE ID: CVE-2015-5665 State: PUBLISHED Published: 2015-10-27T01:00:00 Last Updated: 2024-08-06T06:59:03.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function. Additional Analyst Notes: - CVE Program Container: References: - http://www.ec-cube.net/info/weakness/weakness.php?id=63 - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000166 - http://jvn.jp/en/jp/JVN97278546/index.html - https://www.ec-cube.net/info/weakness/201510_01/
CVE ID: CVE-2015-5666 State: PUBLISHED Published: 2017-09-25T21:00:00 Last Updated: 2024-08-06T06:59:03.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN25086409/index.html - http://www.securityfocus.com/bid/77344 - http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000164.html
CVE ID: CVE-2015-5667 State: PUBLISHED Published: 2015-10-31T01:00:00 Last Updated: 2024-08-06T06:59:04.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/release/HTML-Scrubber - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171 - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172997.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/1729
ackage-announce/2015-November/172997.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172983.html - http://jvn.jp/en/jp/JVN53973084/index.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172934.html
CVE ID: CVE-2015-5668 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T06:59:04.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN58615092/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000167 - http://www.tpj.co.jp/enisys/resource.html
CVE ID: CVE-2015-5669 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T06:59:04.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN33179297/index.html - http://www.tpj.co.jp/enisys/resource.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000168
CVE ID: CVE-2015-5670 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T06:59:03.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000169 - http://www.tpj.co.jp/enisys/resource.html - http://jvn.jp/en/jp/JVN13874649/index.html
CVE ID: CVE-2015-5671 State: PUBLISHED Published: 2015-10-29T10:00:00 Last Updated: 2024-08-06T06:59:04.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN68289108/index.html - http://www.tpj.co.jp/enisys/resource.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000170
CVE ID: CVE-2015-5672 State: PUBLISHED Published: 2015-11-06T11:00:00 Last Updated: 2024-08-06T06:59:03.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data. Additional Analyst Notes: - CVE Program Container: References: - http://www.typemoon.com/support/vulnerability150902.html - http://jvn.jp/en/jp/JVN80144272/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000174
CVE ID: CVE-2015-5673 State: PUBLISHED Published: 2015-11-04T02:00:00 Last Updated: 2024-08-06T06:59:04.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls, which allows remote attackers to execute arbitrary commands via an HTTP request that includes shell metacharacters in an argument to a "gcloud compute" command. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2015-000175 - https://github.com/isucon/isucon5-qualify/commit/150e3e6d851acb31a0b15ce93380a7dab14203fa - https://github.com/isucon/isucon5-qu
github.com/isucon/isucon5-qualify/commit/150e3e6d851acb31a0b15ce93380a7dab14203fa - https://github.com/isucon/isucon5-qualify/pull/5 - http://jvn.jp/en/jp/JVN04281281/index.html
CVE ID: CVE-2015-5674 State: PUBLISHED Published: 2018-02-05T16:00:00 Last Updated: 2024-08-06T06:59:03.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76244 - http://www.securitytracker.com/id/1033185 - https://www.freebsd.org/security/advisories/FreeB
urityfocus.com/bid/76244 - http://www.securitytracker.com/id/1033185 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:19.routed.asc
CVE ID: CVE-2015-5675 State: PUBLISHED Published: 2017-10-10T16:00:00 Last Updated: 2024-08-06T06:59:03.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76485 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21.amd64.asc - http://www.securitytracker.com/id/1033376 - http://www.securityfocus.com/archive/1/536321/100/0/threaded - http://packetstormsecurity.com/files/133335/FreeBSD-Security-Advisory-IRET-Handler-Privilege-Escal
6321/100/0/threaded - http://packetstormsecurity.com/files/133335/FreeBSD-Security-Advisory-IRET-Handler-Privilege-Escalation.html
CVE ID: CVE-2015-5677 State: PUBLISHED Published: 2017-02-07T15:00:00 Last Updated: 2024-08-06T06:59:03.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034678 - https://pierrekim.github.io/blog/2016-01-15-cve-2015-5677-freebsd-bsnmpd.html - https://www.freebsd.org/security/advisories/FreeBSD-SA-16:06.bsnmpd.asc
CVE ID: CVE-2015-5681 State: PUBLISHED Published: 2015-08-18T15:00:00 Last Updated: 2024-08-06T06:59:03.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/07/20/1 - http://www.vapid.dhs.org/advisory.php?v=132 - http://seclists.org/fulldisclosure/2015/Jul/64 - http://www.openwall.com/lists/oss-se
vapid.dhs.org/advisory.php?v=132 - http://seclists.org/fulldisclosure/2015/Jul/64 - http://www.openwall.com/lists/oss-security/2015/07/27/8 - http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.html
CVE ID: CVE-2015-5682 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-06T06:59:03.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapid.dhs.org/advisory.php?v=132 - http://www.openwall.com/lists/oss-security/2015/07/27/8
CVE ID: CVE-2015-5684 State: PUBLISHED Published: 2020-03-27T14:05:01 Last Updated: 2024-08-06T06:59:03.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/lse_bios_notebook
CVE ID: CVE-2015-5685 State: PUBLISHED Published: 2015-08-13T14:00:00 Last Updated: 2024-08-06T06:59:04.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing." Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-366/ - https://github.com/bittorrent/bootstrap-dht/commit/e809ea80e3527e32c40756eddd8b2ae44bc3af1a - http://www.zerodayinitiative.com/advisories/ZDI-15-367/
CVE ID: CVE-2015-5686 State: PUBLISHED Published: 2020-02-27T00:25:58 Last Updated: 2024-08-06T06:59:03.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2015-5686/
CVE ID: CVE-2015-5687 State: PUBLISHED Published: 2015-10-05T14:00:00 Last Updated: 2024-08-06T06:59:03.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anchorcms/anchor-cms/pull/904 - http://seclists.org/fulldisclosure/2015/Aug/76 - http://seclists.org/fulldisclosure/2015/Aug/83
CVE ID: CVE-2015-5688 State: PUBLISHED Published: 2015-09-04T15:00:00 Last Updated: 2024-08-06T06:59:04.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/geddy/geddy/issues/697 - https://github.com/geddy/geddy/releases/tag/v13.0.8 - https://github.com/geddy/geddy/pull/699 - https://nodesecurity.io/advisories/geddy-directory-traversal - https://github.com/geddy/geddy/commit/2de63b68b3aa6c08
- https://nodesecurity.io/advisories/geddy-directory-traversal - https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231