deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9713
Published: 2015-04-01
Description: The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2015/dsa-3209; http://www.openwall.com/lists/oss-security/2015/03/29/2; http://www.securityfocus.com/bid/73217
CVE: CVE-2015-0259
Published: 2015-04-01
Description: OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-345
References: http://lists.openstack.org/pipermail/openstack-announce/2015-March/000341.html; http://rhn.redhat.com/errata/RHSA-2015-0790.html; http://rhn.redhat.com/errata/RHSA-2015-0843.html
CVE: CVE-2015-2294
Published: 2015-04-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firewall_rules.php; (4) queue parameter in an add action to firewall_shaper.php; (5) id parameter in an edit action to services_unbound_acls.php; or (6) filterlogentries_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries_destinationipaddress, (10) filterlogentries_interfaces, (11) filterlogentries_destinationport, (12) filterlogentries_protocolflags, or (13) filterlogentries_qty parameter to diag_logs_filter.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534987/100/0/threaded; http://www.securityfocus.com/bid/73344
CVE: CVE-2015-2751
Published: 2015-04-01
Description: Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
CVSS Score: 7.1 (HIGH)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html
CVE: CVE-2015-2752
Published: 2015-04-01
Description: The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html
CVE: CVE-2015-2755
Published: 2015-04-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130960/WordPress-AB-Google-Map-Travel-CSRF-XSS.html; http://packetstormsecurity.com/files/131155/WordPress-Google-Map-Travel-3.4-XSS-CSRF.html; http://www.securityfocus.com/archive/1/534954/100/0/threaded
CVE: CVE-2015-2756
Published: 2015-04-01
Description: QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html
CVE: CVE-2015-2811
Published: 2015-04-01
Description: XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.3[PII_REDACTED]04 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2111939.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/132358/SAP-NetWeaver-Portal-7.31-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/64; http://www.securityfocus.com/archive/1/535827/100/800/threaded
CVE: CVE-2015-2812
Published: 2015-04-01
Description: XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.3[PII_REDACTED]04 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2093966.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/132356/SAP-NetWeaver-Portal-7.31-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/62; http://www.securityfocus.com/archive/1/535826/100/800/threaded
CVE: CVE-2015-2813
Published: 2015-04-01
Description: XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/132357/SAP-Mobile-Platform-2.3-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/63; http://www.securityfocus.com/archive/1/535828/100/800/threaded
CVE: CVE-2015-2814
Published: 2015-04-01
Description: SAP EMR Unwired (com.sap.mobile.healthcare.emr.v2) and Clinical Task Tracker (com.sap.mobile.healthcare.ctt) does not properly restrict access, which allows remote attackers to change the backendurl, clientid, ssourl, and infopageurl settings via unspecified vectors, aka SAP Security Note 2117079.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/73701; https://erpscan.io/advisories/erpscan-15-002-sap-mobile-healthcare-emr-v2-unauthorized-access/; http://www.securityfocus.com/bid/73701
CVE: CVE-2015-2815
Published: 2015-04-01
Description: Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2063369.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/132353/SAP-NetWeaver-Dispatcher-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2015/Jun/61; http://www.securityfocus.com/archive/1/535825/100/800/threaded
CVE: CVE-2015-2816
Published: 2015-04-01
Description: The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a crafted request, aka SAP Security Note 2134905.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/132363/SAP-Afaria-7-Missing-Authorization-Check.html; http://seclists.org/fulldisclosure/2015/Jun/67; http://www.securityfocus.com/archive/1/535830/100/800/threaded
CVE: CVE-2015-2817
Published: 2015-04-01
Description: The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132359/SAP-Management-Console-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/Jun/65; http://www.securityfocus.com/archive/1/535829/100/800/threaded
CVE: CVE-2015-2818
Published: 2015-04-01
Description: XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125513.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/73896; https://erpscan.io/advisories/erpscan-15-011-sap-mobile-platform-xxe; http://www.securityfocus.com/bid/73896
CVE: CVE-2015-2819
Published: 2015-04-01
Description: SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request, aka SAP Security Note 2108161.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/132364/SYBASE-SQL-Anywhere-12-16-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2015/Jun/68; http://www.securityfocus.com/archive/1/535831/100/800/threaded
CVE: CVE-2015-2820
Published: 2015-04-01
Description: Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/132362/SAP-Afaria-7-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2015/Jun/66; http://www.securityfocus.com/archive/1/535832/100/800/threaded
CVE: CVE-2015-2821
Published: 2015-04-01
Description: TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of other editors via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://typo3.org/teams/security/security-bulletins/typo3-neos/typo3-neos-sa-2015-001/; http://www.securityfocus.com/bid/73700; http://typo3.org/teams/security/security-bulletins/typo3-neos/typo3-neos-sa-2015-001/
CVE: CVE-2015-1233
Published: 2015-04-01
Description: Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1234
Published: 2015-04-01
Description: Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00004.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-0685
Published: 2015-04-03
Description: Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, which allows remote attackers to cause a denial of service (device hang) via crafted IP packets, aka Bug ID CSCub31873.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38124; http://www.securitytracker.com/id/1032004; http://tools.cisco.com/security/center/viewAlert.x?alertId=38124
CVE: CVE-2015-0686
Published: 2015-04-03
Description: The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38193; http://www.securitytracker.com/id/1032021; http://tools.cisco.com/security/center/viewAlert.x?alertId=38193
CVE: CVE-2015-0687
Published: 2015-04-03
Description: The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling, aka Bug ID CSCuq04574.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38194; http://www.securitytracker.com/id/1032022; http://tools.cisco.com/security/center/viewAlert.x?alertId=38194
CVE: CVE-2014-5400
Published: 2015-04-03
Description: The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-260, CWE-200
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-090-03.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-090-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03
CVE: CVE-2014-5403
Published: 2015-04-03
Description: Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-321, CWE-310
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-090-03.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-090-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03
CVE: CVE-2014-5405
Published: 2015-04-03
Description: Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
CVSS Score: 9.0 (HIGH)
CWE: CWE-259, CWE-200
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-090-03.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-090-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03
CVE: CVE-2014-8390
Published: 2015-04-03
Description: Multiple buffer overflows in Schneider Electric VAMPSET before 2.2.168 allow local users to gain privileges via malformed disturbance-recording data in a (1) CFG or (2) DAT file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: http://www.coresecurity.com/advisories/schneider-vampset-stack-and-heap-buffer-overflow; http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-084-01; http://www.securityfocus.com/archive/1/535142/100/0/threaded
CVE: CVE-2015-0666
Published: 2015-04-03
Description: Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150401-dcnm; http://www.securitytracker.com/id/1032009; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150401-dcnm
CVE: CVE-2015-0682
Published: 2015-04-03
Description: Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38113; http://www.securitytracker.com/id/1032002; http://tools.cisco.com/security/center/viewAlert.x?alertId=38113
CVE: CVE-2015-0683
Published: 2015-04-03
Description: Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38118; http://www.securitytracker.com/id/1032003; http://tools.cisco.com/security/center/viewAlert.x?alertId=38118
CVE: CVE-2015-0684
Published: 2015-04-03
Description: SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38114; http://www.securitytracker.com/id/1032001; http://tools.cisco.com/security/center/viewAlert.x?alertId=38114
CVE: CVE-2015-0902
Published: 2015-04-03
Description: The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN75615300/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000046; http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
CVE: CVE-2015-0903
Published: 2015-04-03
Description: Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN58784309/294291/index.html; http://jvn.jp/en/jp/JVN58784309/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000048
CVE: CVE-2015-0976
Published: 2015-04-03
Description: Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0990
Published: 2015-04-03
Description: Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
CVSS Score: 4.4 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-02
CVE: CVE-2015-0991
Published: 2015-04-03
Description: Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0992
Published: 2015-04-03
Description: Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0993
Published: 2015-04-03
Description: Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0994
Published: 2015-04-03
Description: Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0995
Published: 2015-04-03
Description: Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE: CVE-2015-0225
Published: 2015-04-03
Description: The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html; http://rhn.redhat.com/errata/RHSA-2015-1947.html; http://www.mail-archive.com/user%40cassandra.apache.org/msg41819.html
CVE: CVE-2015-2838
Published: 2015-04-03
Description: Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/129; http://www.securityfocus.com/archive/1/534936/100/0/threaded
CVE: CVE-2015-2839
Published: 2015-04-03
Description: The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130931/Citrix-NITRO-SDK-xen_hotfix-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/128; http://www.securityfocus.com/archive/1/534935/100/0/threaded
CVE: CVE-2015-2840
Published: 2015-04-03
Description: Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130936/Citrix-NetScaler-VPX-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/130; http://www.securityfocus.com/archive/1/534934/100/0/threaded
CVE: CVE-2015-2841
Published: 2015-04-03
Description: Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2015/Mar/95; http://securitytracker.com/id/1031928; https://www.exploit-db.com/exploits/36369/
CVE: CVE-2015-0612
Published: 2015-04-03
Description: The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet, aka Bug ID CSCuh25062.
CVSS Score: 7.1 (HIGH)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150401-cuc; http://www.securitytracker.com/id/1032010; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150401-cuc