deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1294
Published: 2015-09-03
Description: Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1295
Published: 2015-09-03
Description: Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1296
Published: 2015-09-03
Description: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1297
Published: 2015-09-03
Description: The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1298
Published: 2015-09-03
Description: The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1299
Published: 2015-09-03
Description: Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1300
Published: 2015-09-03
Description: The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1301
Published: 2015-09-03
Description: Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-6580
Published: 2015-09-03
Description: Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://www.securitytracker.com/id/1033472; http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html
CVE: CVE-2015-6581
Published: 2015-09-03
Description: Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168736.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169258.html
CVE: CVE-2015-6582
Published: 2015-09-03
Description: The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://src.chromium.org/viewvc/blink?view=revision&revision=195670; http://www.securitytracker.com/id/1033472
CVE: CVE-2015-6583
Published: 2015-09-03
Description: Google Chrome before 45.0.2454.85 does not display a location bar for a hosted app's window after navigation away from the installation site, which might make it easier for remote attackers to spoof content via a crafted app, related to browser.cc and hosted_app_browser_controller.cc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://www.securitytracker.com/id/1033472; https://code.google.com/p/chromium/issues/detail?id=467844
CVE: CVE-2015-4538
Published: 2015-09-04
Description: The XML parser in EMC Atmos before 2.2.3.426 and 2.3.x before 2.3.1.0 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/133405/EMC-Atmos-2.3.0-XML-External-Entity-Injection.html; http://seclists.org/bugtraq/2015/Sep/7; http://www.securitytracker.com/id/1033456
CVE: CVE-2015-4544
Published: 2015-09-04
Description: EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4626.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/133441/EMC-Documentum-Content-Server-Privilege-Escalation.html; http://seclists.org/bugtraq/2015/Sep/18; http://packetstormsecurity.com/files/133441/EMC-Documentum-Content-Server-Privilege-Escalation.html
CVE: CVE-2015-6259
Published: 2015-09-04
Description: The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
CVSS Score: 9.4 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcs; http://www.securitytracker.com/id/1033451; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcs
CVE: CVE-2014-9605
Published: 2015-09-04
Description: WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php.  NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.
CVSS Score: 9.4 (HIGH)
CWE: CWE-287
References: https://helpdesk.netsweeper.com/docs/3.1/release_notes/netsweeper_releasenotes/3_1_10_0_release_notes/3.1.10_release_notes.htm; https://helpdesk.netsweeper.com/docs/4.0/release_notes/netsweeper_releasenotes/4_0_9_release_notes/4.0.9_release_notes.htm; https://helpdesk.netsweeper.com/docs/4.1/release_notes/netsweeper_releasenotes/4_1_release_notes/4_1_2_release_notes/4.1.2_release_notes.htm
CVE: CVE-2015-5612
Published: 2015-09-04
Description: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/21/5; http://www.openwall.com/lists/oss-security/2015/07/22/3; https://github.com/octobercms/october/commit/8a4ac533e5cd6b8f92e9ef19fbfbb2f505dc7a9a
CVE: CVE-2015-5688
Published: 2015-09-04
Description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231; https://github.com/geddy/geddy/issues/697; https://github.com/geddy/geddy/pull/699
CVE: CVE-2015-6807
Published: 2015-09-04
Description: Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2561695; https://www.drupal.org/node/2561699; https://www.drupal.org/node/2561951
CVE: CVE-2015-6808
Published: 2015-09-04
Description: Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2561313; https://www.drupal.org/node/2561375; https://www.drupal.org/node/2561313
CVE: CVE-2015-6809
Published: 2015-09-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea, or the (3) data[description] parameter to index.php/areas/saveSection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.bedita.com/news/bedita-3-6-0-corylus-release-announcement-and-new-website; https://github.com/bedita/bedita/issues/623; https://www.exploit-db.com/exploits/38051/
CVE: CVE-2015-6810
Published: 2015-09-04
Description: Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://community.invisionpower.com/release-notes/40121-r22/; https://www.exploit-db.com/exploits/37989/; https://community.invisionpower.com/release-notes/40121-r22/
CVE: CVE-2015-6811
Published: 2015-09-04
Description: SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133378/Cyberoam-CR500iNG-XP-10.6.2-MR-1-Blind-SQL-Injection.html; https://www.exploit-db.com/exploits/38034/; http://packetstormsecurity.com/files/133378/Cyberoam-CR500iNG-XP-10.6.2-MR-1-Blind-SQL-Injection.html
CVE: CVE-2015-6812
Published: 2015-09-04
Description: Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: https://community.invisionpower.com/release-notes/40121-r22/; https://community.invisionpower.com/release-notes/40121-r22/
CVE: CVE-2015-2990
Published: 2015-09-05
Description: Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arbitrary files via a crafted parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN09283606/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000122; http://www.desknets.com/neo/support/mainte/2590/
CVE: CVE-2015-2991
Published: 2015-09-05
Description: Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN08494613/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000123; http://www.nscripter.com/
CVE: CVE-2015-5722
Published: 2015-09-05
Description: buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00009.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168686.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165750.html
CVE: CVE-2015-5986
Published: 2015-09-05
Description: openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00009.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165810.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167465.html
CVE: CVE-2015-6276
Published: 2015-09-05
Description: Cisco TelePresence IX5000 8.0.3 stores a private key associated with an X.509 certificate under the web root with insufficient access control, which allows remote attackers to obtain cleartext versions of HTTPS traffic or spoof devices via a direct request to the certificate directory, aka Bug ID CSCuu63501.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40727; http://www.securitytracker.com/id/1033477; http://tools.cisco.com/security/center/viewAlert.x?alertId=40727
CVE: CVE-2015-2985
Published: 2015-09-05
Description: Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN13684924/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000301; http://jvn.jp/en/jp/JVN13684924/index.html
CVE: CVE-2015-2986
Published: 2015-09-05
Description: Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN24692261/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000302; http://jvn.jp/en/jp/JVN24692261/index.html
CVE: CVE-2015-6818
Published: 2015-09-06
Description: The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=47f4e2d8960ca756ca153ab8e3e93d80449b8c91; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6819
Published: 2015-09-06
Description: Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=84afc6b70d24fc0bf686e43138c96cf60a9445fe; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6820
Published: 2015-09-06
Description: The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=79a98294da6cd85f8c86b34764c5e0c43b09eea3; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6821
Published: 2015-09-06
Description: The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=b160fc290cf49b516c5b6ee0730fd9da7fc623b1; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6822
Published: 2015-09-06
Description: The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6823
Published: 2015-09-06
Description: The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6824
Published: 2015-09-06
Description: The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6825
Published: 2015-09-06
Description: The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f1a38264f20382731cf2cc75fdd98f4c9a84a626; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-6826
Published: 2015-09-06
Description: The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a; http://www.securitytracker.com/id/1033483
CVE: CVE-2015-2989
Published: 2015-09-07
Description: Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Twit BBS allows remote attackers to inject arbitrary web script or HTML via the imagetitle parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN77193915/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000121; http://jvn.jp/en/jp/JVN77193915/index.html
CVE: CVE-2015-5624
Published: 2015-09-07
Description: Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN62078684/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000127; http://jvn.jp/en/jp/JVN62078684/index.html
CVE: CVE-2015-5625
Published: 2015-09-07
Description: Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN00015036/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000128; http://www.opendocman.com/opendocman-v1-3-4-released/