alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-3998 (published 2017-05-17)
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: clickfraud-monitoring, phpwhois_project
Affected products: adsense-click-fraud-monitoring, phpwhois
CVE-2015-3999 (published 2015-05-20)
Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: piriform
Affected products: ccleaner
CVE-2015-4000 (published 2015-05-21)
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-310
Affected vendors: apple, canonical, debian, google, hp, ibm, microsoft, mozilla, openssl, opera, oracle, suse
Affected products: chrome, content_manager, debian_linux, firefox, firefox_esr, firefox_os, hp-ux, internet_explorer, iphone_os, jdk, jre, jrockit, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_software_development_kit, mac_os_x, network_security_services, openssl, opera_browser, safari, seamonkey, sparc-opl_service_processor, suse_linux_enterprise_server, thunderbird, ubuntu_linux
CVE-2015-4001 (published 2015-06-07)
Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Weakness: CWE-189
Affected vendors: linux
Affected products: linux_kernel
CVE-2015-4002 (published 2015-06-07)
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Weakness: CWE-119
Affected vendors: canonical, linux, opensuse
Affected products: linux_kernel, opensuse, ubuntu_linux
CVE-2015-4003 (published 2015-06-07)
The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-189
Affected vendors: linux
Affected products: linux_kernel
CVE-2015-4004 (published 2015-06-07)
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:C)
Weakness: CWE-119
Affected vendors: canonical, linux
Affected products: linux_kernel, ubuntu_linux
CVE-2015-4010 (published 2015-06-09)
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: everybit
Affected products: encrypted_contact_form
CVE-2015-4016 (published 2015-05-20)
The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: valvesoftware
Affected products: steam_client
CVE-2015-4017 (published 2017-08-25)
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-295
Affected vendors: saltstack
Affected products: salt
CVE-2015-4018 (published 2015-05-21)
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: feedwordpress_project
Affected products: feedwordpress
CVE-2015-4020 (published 2015-08-25)
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: oracle, rubygems
Affected products: rubygems, solaris
CVE-2015-4021 (published 2015-06-09)
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-189
Affected vendors: apple, php, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4022 (published 2015-06-09)
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-189
Affected vendors: apple, php, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4024 (published 2015-06-09)
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: apple, hp, oracle, php, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, linux, mac_os_x, php, solaris, system_management_homepage
CVE-2015-4025 (published 2015-06-09)
PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-19
Affected vendors: apple, php, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4026 (published 2015-06-09)
The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-19
Affected vendors: apple, php, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4027 (published 2015-12-17)
The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: acunetix
Affected products: web_vulnerability_scanner
CVE-2015-4029 (published 2015-08-18)
Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: netgate
Affected products: pfsense
CVE-2015-4031 (published 2015-05-29)
Directory traversal vulnerability in saveFile.jsp in the development installation in Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-22
Affected vendors: visualmining
Affected products: netcharts_server
CVE-2015-4032 (published 2015-05-29)
projectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote attackers to rename arbitrary files, and consequently execute them, via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: visual_mining
Affected products: netcharts_server
CVE-2015-4033 (published 2015-07-06)
Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Severity: LOW (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: samsung
Affected products: s-beam
CVE-2015-4034 (published 2015-07-06)
The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.
Severity: HIGH (CVSS 2.0 vector: AV:A/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: samsung
Affected products: galaxy_s5
CVE-2015-4035 (published 2017-07-25)
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: redhat, tukaani
Affected products: enterprise_linux, xz
CVE-2015-4036 (published 2015-08-31)
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: linux
Affected products: linux_kernel
CVE-2015-4037 (published 2015-08-26)
The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-17
Affected vendors: qemu
Affected products: qemu
CVE-2015-4038 (published 2015-06-03)
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: wpmembership
Affected products: wpmembership
CVE-2015-4039 (published 2020-01-06)
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: e-plugins
Affected products: wp_membership
CVE-2015-4040 (published 2015-09-17)
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-22
Affected vendors: f5
Affected products: big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_edge_gateway, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_protocol_security_module, big-ip_wan_optimization_manager, big-ip_webaccelerator, enterprise_manager
CVE-2015-4041 (published 2020-01-24)
The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: gnu
Affected products: coreutils
CVE-2015-4042 (published 2020-01-24)
Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: gnu
Affected products: coreutils
CVE-2015-4043 (published 2018-06-19)
SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: connx
Affected products: esp_hr_management
CVE-2015-4045 (published 2017-05-23)
The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: alienvault
Affected products: open_source_security_information_management
CVE-2015-4046 (published 2017-05-23)
The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: alienvault
Affected products: open_source_security_information_management
CVE-2015-4047 (published 2015-05-29)
racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-476
Affected vendors: canonical, debian, f5, fedoraproject, ipsec-tools
Affected products: big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_protocol_security_manager, big-ip_wan_optimization_manager, big-ip_webaccelerator, big-iq_adc, big-iq_centralized_management, big-iq_cloud, big-iq_cloud_and_orchestration, big-iq_device, big-iq_security, debian_linux, enterprise_manager, fedora, ipsec-tools, ubuntu_linux
CVE-2015-4049 (published 2017-02-03)
Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-119
Affected vendors: unisys
Affected products: mcp-firmware
CVE-2015-4050 (published 2015-06-02)
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-284
Affected vendors: sensiolabs
Affected products: symfony
CVE-2015-4051 (published 2015-06-08)
Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Weakness: CWE-284
Affected vendors: beckhoff
Affected products: ipc_diagnostics
CVE-2015-4053 (published 2015-06-08)
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: ceph
Affected products: ceph-deploy
CVE-2015-4054 (published 2017-05-23)
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: pgbouncer
Affected products: pgbouncer
CVE-2015-4056 (published 2017-02-21)
The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-310
Affected vendors: dell
Affected products: vce_vision_intelligent_operations
CVE-2015-4057 (published 2017-02-21)
The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, which allows remote attackers to discover the admin user password by sniffing the network.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: dell
Affected products: vce_vision_intelligent_operations
CVE-2015-4059 (published 2015-05-29)
Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: wavelink
Affected products: terminal_emulation
CVE-2015-4060 (published 2015-05-29)
Heap-based buffer overflow in the TermProxy (WLTermProxyService.exe) service in Wavelink ConnectPro allows remote attackers to execute arbitrary code via a large HTTP header.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: wavelink
Affected products: connectpro
CVE-2015-4062 (published 2015-05-27)
SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-4063 (published 2015-05-27)
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-4064 (published 2015-05-27)
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: landing_pages_project
Affected products: landing_pages
CVE-2015-4065 (published 2015-05-27)
Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: landing_pages_project
Affected products: landing_pages
CVE-2015-4066 (published 2015-05-27)
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: tri
Affected products: gigpress
CVE-2015-4067 (published 2015-05-29)
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-189
Affected vendors: dell
Affected products: netvault_backup
CVE-2015-4068 (published 2015-05-29)
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-22
Affected vendors: arcserve
Affected products: udp
Added to CISA KEV catalog: 2022-03-25
KEV required action: Apply updates per vendor instructions.
CVE-2015-4069 (published 2015-05-29)
The EdgeServiceImpl web service in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive credentials via a crafted SOAP request to the (1) getBackupPolicy or (2) getBackupPolicies method.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)
Weakness: CWE-200
Affected vendors: arcserve
Affected products: arcserve_unified_data_protection
CVE-2015-4070 (published 2017-05-17)
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: wow_new_media
Affected products: wow_moodboard_lite
CVE-2015-4071 (published 2017-08-18)
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: helpdesk_pro_project
Affected products: helpdesk_pro
CVE-2015-4072 (published 2017-09-20)
Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: helpdesk_pro_project
Affected products: helpdesk_pro
CVE-2015-4073 (published 2017-09-20)
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: helpdesk_pro_project
Affected products: helpdesk_pro
CVE-2015-4074 (published 2017-09-20)
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: helpdesk_pro_project
Affected products: helpdesk_pro
CVE-2015-4075 (published 2017-09-20)
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: helpdeskpro
Affected products: helpdesk_pro
CVE-2015-4077 (published 2015-09-03)
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: fortinet
Affected products: forticlient
CVE-2015-4078 (published 2017-03-23)
Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cloudera
Affected products: cloudera_manager, navigator
CVE-2015-4080 (published 2015-06-09)
The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-310
Affected vendors: kankun
Affected products: smartsocket
CVE-2015-4082 (published 2017-08-18)
attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-264
Affected vendors: attic_project
Affected products: attic
CVE-2015-4084 (published 2015-05-28)
Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: free-counter
Affected products: free_counter
CVE-2015-4085 (published 2017-09-07)
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: etherpad
Affected products: etherpad
CVE-2015-4089 (published 2017-09-19)
Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpfastestcache
Affected products: wp_fastest_cache
CVE-2015-4091 (published 2015-05-26)
XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: sap
Affected products: sap_netweaver_application_server_java
CVE-2015-4092 (published 2015-05-26)
Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: sap
Affected products: afaria
CVE-2015-4093 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: elastic
Affected products: kibana
CVE-2015-4094 (published 2015-06-02)
The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Weakness: CWE-295
Affected vendors: thycotic
Affected products: secret_server
CVE-2015-4100 (published 2017-12-21)
Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-295
Affected vendors: puppet
Affected products: puppet_enterprise
CVE-2015-4103 (published 2015-06-03)
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-264
Affected vendors: xen
Affected products: xen
CVE-2015-4104 (published 2015-06-03)
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-264
Affected vendors: xen
Affected products: xen
CVE-2015-4105 (published 2015-06-03)
Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: xen
Affected products: xen
CVE-2015-4106 (published 2015-06-03)
QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-863
Affected vendors: canonical, citrix, debian, fedoraproject, qemu, suse
Affected products: debian_linux, fedora, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_software_development_kit, qemu, ubuntu_linux, xenserver
CVE-2015-4108 (published 2015-06-10)
Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: wftpserver
Affected products: wing_ftp_server
CVE-2015-4109 (published 2015-06-09)
Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: usersultra
Affected products: usersultra
CVE-2015-4111 (published 2015-07-20)
mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: blackberry
Affected products: blackberry_link
CVE-2015-4112 (published 2015-11-19)
The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: blackberry
Affected products: enterprise_server
CVE-2015-4116 (published 2016-05-16)
Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: opensuse, php
Affected products: leap, php
CVE-2015-4117 (published 2018-02-28)
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: vestacp
Affected products: control_panel
CVE-2015-4118 (published 2015-06-15)
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.  NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: ispconfig
Affected products: ispconfig
CVE-2015-4119 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: ispconfig
Affected products: ispconfig
CVE-2015-4127 (published 2015-05-28)
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: church_admin_project
Affected products: church_admin
CVE-2015-4129 (published 2015-07-05)
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: intelliants
Affected products: subrion_cms
CVE-2015-4132 (published 2015-05-28)
Multiple cross-site scripting (XSS) vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: arubanetworks
Affected products: clearpass_policy_manager
CVE-2015-4133 (published 2015-05-28)
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: reflex_gallery_project
Affected products: reflex_gallery
CVE-2015-4134 (published 2015-05-28)
Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: phpwind
Affected products: phpwind
CVE-2015-4135 (published 2015-05-28)
Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: phpwind
Affected products: phpwind
CVE-2015-4137 (published 2015-05-29)
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: milw0rm_project
Affected products: milw0rm_clone_script
CVE-2015-4138 (published 2015-05-30)
The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: blue_coat
Affected products: ssl_visibility_appliance_sv1800, ssl_visibility_appliance_sv1800_firmware, ssl_visibility_appliance_sv2800, ssl_visibility_appliance_sv2800_firmware, ssl_visibility_appliance_sv3800, ssl_visibility_appliance_sv3800_firmware, ssl_visibility_appliance_sv800, ssl_visibility_appliance_sv800_firmware
CVE-2015-4139 (published 2015-06-18)
Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: wp_smiley_project
Affected products: wp_smiley
CVE-2015-4140 (published 2015-06-18)
Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: wp_smiley_project
Affected products: wp_smiley
CVE-2015-4141 (published 2015-06-15)
The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: opensuse, w1.fi
Affected products: hostapd, opensuse, wpa_supplicant
CVE-2015-4142 (published 2015-06-15)
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: opensuse, redhat, w1.fi
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_server, enterprise_linux_workstation, hostapd, opensuse, wpa_supplicant
CVE-2015-4143 (published 2015-06-15)
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: opensuse, w1.fi
Affected products: hostapd, opensuse, wpa_supplicant
CVE-2015-4144 (published 2015-06-15)
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: opensuse, w1.fi
Affected products: hostapd, opensuse, wpa_supplicant
CVE-2015-4145 (published 2015-06-15)
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: opensuse, w1.fi
Affected products: hostapd, opensuse, wpa_supplicant
CVE-2015-4146 (published 2015-06-15)
The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: opensuse, w1.fi
Affected products: hostapd, opensuse, wpa_supplicant
CVE-2015-4147 (published 2015-06-09)
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-19
Affected vendors: apple, php, redhat
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4148 (published 2015-06-09)
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-20
Affected vendors: apple, php, redhat
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, mac_os_x, php
CVE-2015-4152 (published 2015-06-15)
Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Weakness: CWE-22
Affected vendors: elastic
Affected products: logstash
CVE-2015-4153 (published 2015-06-10)
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-22
Affected vendors: zanematthew
Affected products: zm_ajax_login_\&_register
CVE-2015-4155 (published 2015-06-02)
GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:P/A:P)
Weakness: CWE-59
Affected vendors: gnu
Affected products: parallel