deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1300
Published: 2016-01-27
Description: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux82582.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-uc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-uc
CVE: CVE-2016-0868
Published: 2016-01-28
Description: Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034861; https://ics-cert.us-cert.gov/advisories/ICSA-16-026-02; http://www.securitytracker.com/id/1034861
CVE: CVE-2015-7464
Published: 2016-01-29
Description: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.
CVSS Score: 7.5 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972485; http://www.securityfocus.com/bid/96750; http://www-01.ibm.com/support/docview.wss?uid=swg21972485
CVE: CVE-2016-3197
Published: 2016-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-3197.  Reason: This candidate is a duplicate of CVE-2015-3197.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2015-3197 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-8770
Published: 2016-01-29
Description: Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html
CVE: CVE-2015-8789
Published: 2016-01-29
Description: Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.
CVSS Score: 9.6 (CRITICAL)
References: http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html; http://www.debian.org/security/2016/dsa-3538
CVE: CVE-2015-8790
Published: 2016-01-29
Description: The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html; http://www.debian.org/security/2016/dsa-3538
CVE: CVE-2015-8791
Published: 2016-01-29
Description: The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html; http://www.debian.org/security/2016/dsa-3538
CVE: CVE-2015-8792
Published: 2016-01-29
Description: The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-200
References: http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html; http://www.debian.org/security/2016/dsa-3526
CVE: CVE-2015-8793
Published: 2016-01-29
Description: Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://trac.roundcube.net/ticket/1490417; http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2; https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/
CVE: CVE-2015-8794
Published: 2016-01-29
Description: Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://trac.roundcube.net/changeset/6ccd4c54b/github; http://trac.roundcube.net/changeset/e84fafcec/github; http://trac.roundcube.net/ticket/1490379
CVE: CVE-2016-1879
Published: 2016-01-29
Description: The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, when the kernel is configured for IPv6, allows remote attackers to cause a denial of service (assertion failure or NULL pointer dereference and kernel panic) via a crafted ICMPv6 packet.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/135369/FreeBSD-SCTP-ICMPv6-Denial-Of-Service.html; http://www.securitytracker.com/id/1034673; https://www.exploit-db.com/exploits/39305/
CVE: CVE-2016-1882
Published: 2016-01-29
Description: FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.securitytracker.com/id/1034677; https://security.FreeBSD.org/advisories/FreeBSD-SA-16:05.tcp.asc; http://www.securitytracker.com/id/1034677
CVE: CVE-2015-7521
Published: 2016-01-29
Description: The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287
References: http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C[PII_REDACTED]5008.2154F185EB%40minotaur.apache.org%3E; http://packetstormsecurity.com/files/135836/Apache-Hive-Authorization-Bypass.html; http://www.openwall.com/lists/oss-security/2016/01/28/12
CVE: CVE-2015-8772
Published: 2016-01-29
Description: McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-19
References: http://seclists.org/fulldisclosure/2016/Jan/90; https://www.nettitude.co.uk/mcafee-file-lock-driver-kernel-memory-leak/; http://seclists.org/fulldisclosure/2016/Jan/90
CVE: CVE-2015-8773
Published: 2016-01-29
Description: Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attackers to cause a denial of service (system crash) via a long vault GUID in an ioctl call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2016/Jan/92; https://www.nettitude.co.uk/mcafee-file-lock-driver-kernel-stack-based-bof/; http://seclists.org/fulldisclosure/2016/Jan/92
CVE: CVE-2016-0737
Published: 2016-01-29
Description: OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2016-0128.html; http://rhn.redhat.com/errata/RHSA-2016-0155.html; http://rhn.redhat.com/errata/RHSA-2016-0329.html
CVE: CVE-2016-0738
Published: 2016-01-29
Description: OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176713.html; http://rhn.redhat.com/errata/RHSA-2016-0128.html; http://rhn.redhat.com/errata/RHSA-2016-0155.html
CVE: CVE-2016-0754
Published: 2016-01-29
Description: cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://curl.haxx.se/docs/adv_20160127B.html; http://curl.haxx.se/docs/adv_20160127B.html
CVE: CVE-2016-0755
Published: 2016-01-29
Description: The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: http://curl.haxx.se/docs/adv_20160127A.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html
CVE: CVE-2016-0756
Published: 2016-01-29
Description: The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://blog.prosody.im/prosody-0-9-10-released/; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html
CVE: CVE-2016-1493
Published: 2016-01-29
Description: Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: http://packetstormsecurity.com/files/135314/Intel-Driver-Update-Utility-2.2.0.5-Man-In-The-Middle.html; http://seclists.org/fulldisclosure/2016/Jan/56; http://www.coresecurity.com/advisories/intel-driver-update-utility-mitm
CVE: CVE-2015-7923
Published: 2016-01-30
Description: Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-028-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-028-01
CVE: CVE-2016-1303
Published: 2016-01-30
Description: The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-sbs; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-sbs
CVE: CVE-2016-1304
Published: 2016-01-30
Description: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux82596.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-uc; http://www.securitytracker.com/id/1034868; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-uc
CVE: CVE-2016-1488
Published: 2016-01-30
Description: Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdf
CVE: CVE-2016-0867
Published: 2016-01-30
Description: CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-021-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-021-01
CVE: CVE-2016-1136
Published: 2016-01-30
Description: Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000007; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1137
Published: 2016-01-30
Description: Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 7.4 (HIGH)
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000008; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1138
Published: 2016-01-30
Description: CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000009; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1139
Published: 2016-01-30
Description: Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000010; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1140
Published: 2016-01-30
Description: KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-254
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000011; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1141
Published: 2016-01-30
Description: KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN54686544/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000012; http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06
CVE: CVE-2016-1143
Published: 2016-01-30
Description: Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12165579/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000016; https://github.com/ikeay/vinemv/commit/f41efbcac1f9262a161ebc1babfcf55fae9e939a
CVE: CVE-2016-1144
Published: 2016-01-30
Description: Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN26921563/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000017; http://www.ws-download.net/info.php?type=version&id=V0001081
CVE: CVE-2016-1145
Published: 2016-01-30
Description: Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jpn.nec.com/security-info/secinfo/nv16-001.html; http://jvn.jp/en/jp/JVN03050861/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000015
CVE: CVE-2016-1985
Published: 2016-01-30
Description: HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/82259; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953244; http://www.securityfocus.com/bid/82259
CVE: CVE-2016-1930
Published: 2016-01-31
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00003.html
CVE: CVE-2016-1931
Published: 2016-01-31
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-01.html
CVE: CVE-2016-1933
Published: 2016-01-31
Description: Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted GIF image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-02.html
CVE: CVE-2016-1935
Published: 2016-01-31
Description: Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00003.html
CVE: CVE-2016-1937
Published: 2016-01-31
Description: The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-06.html
CVE: CVE-2016-1938
Published: 2016-01-31
Description: The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html
CVE: CVE-2016-1939
Published: 2016-01-31
Description: Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7208.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-04.html
CVE: CVE-2016-1940
Published: 2016-01-31
Description: Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during (1) shortcut opening or (2) BOOKMARK intent processing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-17
References: http://www.mozilla.org/security/announce/2016/mfsa2016-05.html; http://www.securitytracker.com/id/1034825; https://bugzilla.mozilla.org/show_bug.cgi?id=1208525
CVE: CVE-2016-1941
Published: 2016-01-31
Description: The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.mozilla.org/security/announce/2016/mfsa2016-08.html; http://www.securitytracker.com/id/1034825; https://bugzilla.mozilla.org/show_bug.cgi?id=1116385
CVE: CVE-2016-1942
Published: 2016-01-31
Description: Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2) resource: URI.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-09.html
CVE: CVE-2016-1943
Published: 2016-01-31
Description: Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-09.html