alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-4282 (published 2015-11-06)
Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: mobility_services_engine
CVE-2015-4283 (published 2015-07-21)
Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: videoscape_policy_resource_manager
CVE-2015-4284 (published 2015-07-22)
The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets, aka Bug ID CSCur70670.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: asr_9001, asr_9006, asr_9010, asr_9904, asr_9912, asr_9922, ios_xr
CVE-2015-4285 (published 2015-07-23)
The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2, 5.1.3, 5.2.1, and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and UDP ports during the processing of flow base entries, which allows remote attackers to cause a denial of service (resource consumption) by sending traffic to these ports continuously, aka Bug ID CSCur88273.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios_xr
CVE-2015-4286 (published 2015-07-29)
The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: unified_computing_system_central_software
CVE-2015-4287 (published 2015-07-29)
Cisco Firepower Extensible Operating System 1.1(1.86) on Firepower 9000 devices allows remote attackers to bypass intended access restrictions and obtain sensitive device information by visiting an unspecified web page, aka Bug ID CSCuu82230.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: cisco
Affected products: firepower_extensible_operating_system
CVE-2015-4288 (published 2015-07-29)
The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-310
Affected vendors: cisco
Affected products: content_security_management_appliance, email_security_appliance, web_security_appliance
CVE-2015-4289 (published 2015-08-01)
Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Weakness: CWE-22
Affected vendors: cisco
Affected products: anyconnect_secure_mobility_client
CVE-2015-4290 (published 2015-07-29)
The kernel extension in Cisco AnyConnect Secure Mobility Client 4.0(2049) on OS X allows local users to cause a denial of service (panic) via vectors involving contiguous memory locations, aka Bug ID CSCut12255.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-119
Affected vendors: apple, cisco
Affected products: anyconnect_secure_mobility_client, mac_os_x
CVE-2015-4291 (published 2015-08-01)
Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted series of fragmented (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCtd72617.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios_xe
CVE-2015-4292 (published 2015-08-01)
Cross-site scripting (XSS) vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: prime_central_for_hosted_collaboration_solution_assurance
CVE-2015-4293 (published 2015-07-30)
The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: ios_xe
CVE-2015-4294 (published 2015-08-01)
Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: unified_communications_manager_im_and_presence_service
CVE-2015-4295 (published 2015-08-01)
The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: unified_communications_manager
CVE-2015-4296 (published 2015-08-19)
Nexus Data Broker (NDB) on Cisco Nexus 3000 devices with software 6.0(2)A6(1) allows remote attackers to cause a denial of service (Java process restart) via crafted connections to the Java application, aka Bug ID CSCut87006.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_31128pq, nexus_3132q, nexus_3164q, nexus_3172, nexus_3232c, nexus_3524, nexus_3548, nx-os
CVE-2015-4297 (published 2015-08-19)
Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: cisco
Affected products: webex_node_for_mcs
CVE-2015-4298 (published 2015-08-19)
Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-284
Affected vendors: cisco
Affected products: unified_web_and_e-mail_interaction_manager
CVE-2015-4299 (published 2015-08-19)
Cisco Unified Web and E-Mail Interaction Manager 9.0(2) improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders via unspecified vectors, aka Bug ID CSCuo89046.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:P)
Weakness: CWE-284
Affected vendors: cisco
Affected products: unified_web_and_e-mail_interaction_manager
CVE-2015-4301 (published 2015-08-19)
Cisco NX-OS on Nexus 9000 devices 11.1(1c) allows remote authenticated users to cause a denial of service (device hang) via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: cisco
Affected products: nexus_93120tx, nexus_93128tx, nexus_9332pq, nexus_9336pq_aci_spine, nexus_9372px, nexus_9372tx, nx-os
CVE-2015-4302 (published 2015-08-19)
The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Weakness: CWE-284
Affected vendors: cisco
Affected products: firesight_system_software
CVE-2015-4303 (published 2015-08-20)
Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4304 (published 2015-09-20)
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: prime_collaboration_assurance
CVE-2015-4305 (published 2015-09-20)
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: cisco
Affected products: prime_collaboration_assurance
CVE-2015-4306 (published 2015-09-20)
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: prime_collaboration_assurance
CVE-2015-4307 (published 2015-09-20)
The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: prime_collaboration_provisioning
CVE-2015-4308 (published 2015-08-19)
The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: edge_bluebird_operating_system
CVE-2015-4310 (published 2015-08-19)
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: finesse
CVE-2015-4314 (published 2015-08-20)
The System Snapshot feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4315 (published 2015-08-20)
The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4316 (published 2015-08-20)
The Mobile and Remote Access (MRA) endpoint-validation feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka Bug ID CSCuv40396.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4317 (published 2015-08-20)
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4318 (published 2015-08-20)
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4319 (published 2015-08-20)
The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:P)
Weakness: CWE-255
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4320 (published 2015-08-20)
The Configuration Log File component in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4321 (published 2015-08-20)
The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote attackers to bypass uRPF validation via spoofed packets, aka Bug ID CSCuv60724.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: adaptive_security_appliance_software
CVE-2015-4322 (published 2015-08-19)
Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Weakness: CWE-264
Affected vendors: cisco
Affected products: content_security_management_appliance
CVE-2015-4323 (published 2015-08-19)
Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.9); Nexus 3000 devices 6.0(2)U5(1.41), 7.0(3)I2(0.373), and 7.3(0)ZN(0.83); Nexus 4000 devices 4.1(2)E1(1b); Nexus 7000 devices 6.2(14)S1; Nexus 9000 devices 7.3(0)ZN(0.9); and MDS 9000 devices 6.2 (13) and 7.1(0)ZN(91.99) and MDS SAN-OS 7.1(0)ZN(91.99) allows remote attackers to cause a denial of service (device outage) via a crafted ARP packet, related to incorrect MTU validation, aka Bug IDs CSCuv71933, CSCuv61341, CSCuv61321, CSCuu78074, CSCut37060, CSCuv61266, CSCuv61351, CSCuv61358, and CSCuv61366.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-119
Affected vendors: cisco
Affected products: mds_9000_nx-os, nexus_1000v, nexus_3016, nexus_3048, nexus_3064, nexus_31128pq, nexus_3132q, nexus_3164q, nexus_3172, nexus_3232c, nexus_3264q, nexus_3524, nexus_3548, nexus_4001i, nexus_7000, nexus_7700, nexus_93120tx, nexus_93128tx, nexus_9332pq, nexus_9336pq_aci_spine, nexus_9372px, nexus_9372tx, nexus_9396px, nexus_9396tx, nexus_9504
CVE-2015-4324 (published 2015-08-19)
Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(0)N1(0.1), and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to cause a denial of service (IGMP process restart) via a malformed IGMPv3 packet that is mishandled during memory allocation, aka Bug IDs CSCuv69713, CSCuv69717, CSCuv69723, CSCuv69732, and CSCuv48908.
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-119
Affected vendors: cisco
Affected products: nexus_1000v, nexus_3016, nexus_3048, nexus_3064, nexus_31128pq, nexus_3132q, nexus_3164q, nexus_3172, nexus_3232c, nexus_3264q, nexus_3524, nexus_3548, nexus_4001i, nexus_7000, nexus_7700, nexus_93120tx, nexus_93128tx, nexus_9332pq, nexus_9336pq_aci_spine, nexus_9372px, nexus_9372tx, nexus_9396px, nexus_9396tx, nexus_9504, nexus_9508
CVE-2015-4325 (published 2015-10-12)
The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4327 (published 2015-08-20)
The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4328 (published 2015-08-20)
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4329 (published 2015-08-20)
The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4330 (published 2015-09-02)
A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-78
Affected vendors: cisco
Affected products: telepresence_video_communication_server_software
CVE-2015-4331 (published 2015-08-22)
Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: cisco
Affected products: prime_infrastructure
CVE-2015-4334 (published 2015-12-07)
The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: symantec
Affected products: proxysg_firmware
CVE-2015-4335 (published 2015-06-09)
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-17
Affected vendors: debian, redislabs
Affected products: debian_linux, redis
CVE-2015-4336 (published 2015-06-17)
cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-77
Affected vendors: xcloner
Affected products: xcloner
CVE-2015-4337 (published 2015-06-17)
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: xcloner
Affected products: xcloner
CVE-2015-4338 (published 2015-06-17)
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-94
Affected vendors: xcloner
Affected products: xcloner
CVE-2015-4342 (published 2015-06-17)
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: cacti, fedoraproject
Affected products: cacti, fedora
CVE-2015-4344 (published 2015-06-15)
The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource restrictions via vectors related to page caching.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: services_basic_authentication_project
Affected products: services_basic_authentication
CVE-2015-4345 (published 2015-06-15)
The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: restful_web_services_project
Affected products: restful_web_services
CVE-2015-4346 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: sms_framework_project
Affected products: sms_framework
CVE-2015-4347 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified path arguments.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: inlinks_project
Affected products: inlinks
CVE-2015-4348 (published 2015-06-15)
SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: spider_contacts_project
Affected products: spider_contacts
CVE-2015-4349 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete contact categories via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-352
Affected vendors: spider_contacts_project
Affected products: spider_contacts
CVE-2015-4350 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: web-dorado
Affected products: spider_catalog
CVE-2015-4351 (published 2015-06-15)
The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:P)
Weakness: CWE-264
Affected vendors: web-dorado
Affected products: web-dorado_spider_video_player
CVE-2015-4352 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-352
Affected vendors: web-dorado
Affected products: web-dorado_spider_video_player
CVE-2015-4353 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-352
Affected vendors: osscube
Affected products: custom_sitemap
CVE-2015-4354 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: ubercart_webform_integration_project
Affected products: ubercart_webform_integration
CVE-2015-4355 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: watchdog_aggregator_project
Affected products: watchdog_aggregator
CVE-2015-4356 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: webform_project
Affected products: webform
CVE-2015-4357 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a webform block.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: webform_project
Affected products: webform
CVE-2015-4358 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: ubercart_discount_coupons_project
Affected products: ubercart_discount_coupons
CVE-2015-4359 (published 2015-06-15)
Multiple cross-site scripting (XSS) vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: registration_codes_project
Affected products: registration_codes
CVE-2015-4360 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: registration_codes_project
Affected products: registration_codes
CVE-2015-4361 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete registration codes via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: registration_codes_project
Affected products: registration_codes
CVE-2015-4362 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in tracking_code.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that disable tracking codes via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: tracking_code_project
Affected products: tracking_code
CVE-2015-4363 (published 2015-06-15)
Open redirect vulnerability in the finder_form_goto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: finder_project
Affected products: finder
CVE-2015-4364 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that (1) enable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/enable or (2) disable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/disable. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: campaign_monitor_project
Affected products: campaign_monitor
CVE-2015-4365 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: taxonomy_accordion_project
Affected products: taxonomy_accordion
CVE-2015-4366 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: mover_project
Affected products: mover
CVE-2015-4367 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer blocks" permission to inject arbitrary web script or HTML via vectors related to block content.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: simple_subscription_project
Affected products: simple_subscription
CVE-2015-4368 (published 2015-06-15)
The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: commerce_ogone_project
Affected products: commerce_ogone
CVE-2015-4369 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Trick Question" permission to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: trick_question_project
Affected products: trick_question
CVE-2015-4370 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: site_documentation_project
Affected products: site_documentation
CVE-2015-4371 (published 2015-06-15)
Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: perfecto_project
Affected products: perfecto
CVE-2015-4372 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: image_title_project
Affected products: image_title
CVE-2015-4373 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes posted in an Organic Groups group.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: og_tabs_project
Affected products: og_tabs
CVE-2015-4374 (published 2015-06-16)
Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: webform_project
Affected products: webform
CVE-2015-4375 (published 2015-06-15)
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: chaos_tool_suite_project
Affected products: ctools
CVE-2015-4376 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Profile2 Privacy Levels" permission to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: profile2_privacy_project
Affected products: profile2_privacy
CVE-2015-4377 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: petition_project
Affected products: petition
CVE-2015-4378 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: crumbs_project
Affected products: crumbs
CVE-2015-4379 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: webform_multiple_file_upload_project
Affected products: webform_multiple_file_upload
CVE-2015-4380 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: linear_case_project
Affected products: linear_case
CVE-2015-4381 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice" content type.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: invoice_project
Affected products: invoice
CVE-2015-4382 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) create, (2) delete, or (3) alter invoices via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: invoice_project
Affected products: invoice
CVE-2015-4383 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: decisions_project
Affected products: decisions
CVE-2015-4384 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: ubercart_webform_checkout_pane_project
Affected products: ubercart_webform_checkout_pane
CVE-2015-4385 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: imagefield_info_project
Affected products: imagefield_info
CVE-2015-4386 (published 2015-06-15)
Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: entitybulkdelete_project
Affected products: entitybulkdelete
CVE-2015-4387 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal, when a site has a policy that uses the username constraint, allows remote attackers to inject arbitrary web script or HTML via a crafted username that is imported from an external source.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: password_policy_project
Affected products: password_policy
CVE-2015-4388 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the keywords passed by the user to the list" option is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted search query.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: current_search_links_project
Affected products: current_search_links
CVE-2015-4389 (published 2015-06-15)
The Open Graph Importer (og_tag_importer) 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import og_tag_importer" permission.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: open_graph_importer_project
Affected products: open_graph_importer
CVE-2015-4390 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) continue or (2) delete an ongoing import via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: user_import_project
Affected products: user_import
CVE-2015-4391 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: civicrm
Affected products: civicrm_private_report
CVE-2015-4392 (published 2015-06-15)
Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: display_suite_project
Affected products: display_suite
CVE-2015-4393 (published 2015-06-15)
The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: services_project
Affected products: services
CVE-2015-4394 (published 2015-06-15)
The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: services_project
Affected products: services
CVE-2015-4395 (published 2015-06-15)
The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: hybridauth_social_login_project
Affected products: hybridauth_social_login
CVE-2015-4396 (published 2015-06-15)
Multiple cross-site request forgery (CSRF) vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that (1) create, (2) delete, or (3) set priorities to keywords via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: keyword_research_project
Affected products: keyword_research
CVE-2015-4397 (published 2015-06-15)
Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: node_template_project
Affected products: node_template
CVE-2015-4398 (published 2015-06-16)
Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Affected vendors: chaos_tool_suite_project
Affected products: ctools
CVE-2015-4400 (published 2018-02-06)
Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-255
Affected vendors: ring
Affected products: ring, ring_firmware