deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7528
Published: 2016-04-11
Description: Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2015-2615.html; https://access.redhat.com/errata/RHSA-2015:2544; https://github.com/kubernetes/kubernetes/pull/17886
CVE: CVE-2015-8398
Published: 2016-04-11
Description: Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/537232/100/0/threaded; https://www.exploit-db.com/exploits/39170/; http://www.securityfocus.com/archive/1/537232/100/0/threaded
CVE: CVE-2015-8399
Published: 2016-04-11
Description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/537232/100/0/threaded; https://www.exploit-db.com/exploits/39170/; http://www.securityfocus.com/archive/1/537232/100/0/threaded
CVE: CVE-2015-8604
Published: 2016-04-11
Description: SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2652; http://packetstormsecurity.com/files/135191/Cacti-0.8.8f-graphs_new.php-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Jan/16
CVE: CVE-2015-8614
Published: 2016-04-11
Description: Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=d390fa07f5548f3173dd9cc13b233db5ce934c82; http://lists.opensuse.org/opensuse-updates/2016-01/msg00000.html; http://www.claws-mail.org/news.php
CVE: CVE-2015-8708
Published: 2016-04-11
Description: Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/12/31/1; https://security.gentoo.org/glsa/201606-11; http://www.openwall.com/lists/oss-security/2015/12/31/1
CVE: CVE-2015-8710
Published: 2016-04-11
Description: The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1089.html; http://www.debian.org/security/2015/dsa-3430; http://www.openwall.com/lists/oss-security/2015/04/19/4
CVE: CVE-2015-5158
Published: 2016-04-12
Description: Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/76016; http://www.securitytracker.com/id/1033095; https://lists.nongnu.org/archive/html/qemu-devel/2015-07/msg04558.html
CVE: CVE-2015-8108
Published: 2016-04-12
Description: The management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, px4-400r, and px4-300d NAS devices with firmware before 4.1.204.33661 allows remote attackers to obtain sensitive device information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: https://support.lenovo.com/us/en/product_security/len_3846; https://support.lenovo.com/us/en/product_security/len_3846
CVE: CVE-2015-8833
Published: 2016-04-12
Description: Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00109.html; http://www.debian.org/security/2016/dsa-3528
CVE: CVE-2015-8841
Published: 2016-04-12
Description: Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/136082/ESET-NOD32-Heap-Overflow.html; http://www.virusradar.com/en/update/info/11861; https://bugs.chromium.org/p/project-zero/issues/detail?id=466
CVE: CVE-2016-1568
Published: 2016-04-12
Description: Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c[PII_REDACTED]3167703fab; http://rhn.redhat.com/errata/RHSA-2016-0084.html; http://rhn.redhat.com/errata/RHSA-2016-0086.html
CVE: CVE-2016-1885
Published: 2016-04-12
Description: Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/136276/FreeBSD-Kernel-amd64_set_ldt-Heap-Overflow.html; http://seclists.org/fulldisclosure/2016/Mar/56; http://seclists.org/fulldisclosure/2016/Mar/67
CVE: CVE-2016-2857
Published: 2016-04-12
Description: The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=362786f14a753d8a5256ef97d7c10ed576d6572b; http://rhn.redhat.com/errata/RHSA-2016-2670.html; http://rhn.redhat.com/errata/RHSA-2016-2671.html
CVE: CVE-2016-3985
Published: 2016-04-12
Description: The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenticated users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035129; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40166; http://www.securitytracker.com/id/1035129
CVE: CVE-2016-3986
Published: 2016-04-12
Description: Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/136090/Avast-Authenticode-Parsing-Memory-Corruption.html; https://code.google.com/p/google-security-research/issues/detail?id=668; https://www.exploit-db.com/exploits/39530/
CVE: CVE-2016-3987
Published: 2016-04-12
Description: The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://blog.trendmicro.com/information-on-reported-vulnerabilities-in-trend-micro-password-manager/; http://packetstormsecurity.com/files/135222/TrendMicro-Node.js-HTTP-Server-Command-Execution.html; http://www.securitytracker.com/id/1034662
CVE: CVE-2015-3268
Published: 2016-04-12
Description: Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ofbiz.apache.org/download.html#vulnerabilities; http://packetstormsecurity.com/files/136638/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html; http://www.securityfocus.com/archive/1/538033/100/0/threaded
CVE: CVE-2015-5167
Published: 2016-04-12
Description: The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/82871; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; https://mail-archives.apache.org/mod_mbox/ranger-dev/201602.mbox/%3CD2D9A4C5.114ECA%25vel%40apache.org%3E
CVE: CVE-2015-8021
Published: 2016-04-12
Description: Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; BIG-IP AAM 11.4.0 before HF8 and 11.4.1 before HF6; BIG-IP AFM and PEM 11.3.x, 11.4.0 before HF8, and 11.4.1 before HF6; and BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF11 and 11.3.0 allows remote authenticated users to upload files via uploadImage.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/82340; http://www.securitytracker.com/id/1034781; https://support.f5.com/kb/en-us/solutions/public/k/49/sol49580002.html
CVE: CVE-2015-8346
Published: 2016-04-12
Description: app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-199
References: http://www.debian.org/security/2016/dsa-3529; http://www.redmine.org/news/102; https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
CVE: CVE-2015-8473
Published: 2016-04-12
Description: The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2016/dsa-3529; http://www.securityfocus.com/bid/78621; https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22
CVE: CVE-2015-8474
Published: 2016-04-12
Description: Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
CVSS Score: 7.4 (HIGH)
References: http://www.debian.org/security/2016/dsa-3529; http://www.redmine.org/news/101; http://www.securityfocus.com/bid/78625
CVE: CVE-2015-8537
Published: 2016-04-12
Description: app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2016/dsa-3529; http://www.redmine.org/news/103; https://github.com/redmine/redmine/commit/7e423fb4538247d59e01958c48b491f196a1de56
CVE: CVE-2015-8702
Published: 2016-04-12
Description: The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3527; http://www.inspircd.org/2015/04/16/v2019-released.html; https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559
CVE: CVE-2016-0733
Published: 2016-04-12
Description: The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/82871; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; https://issues.apache.org/jira/browse/RANGER-835
CVE: CVE-2016-1866
Published: 2016-04-12
Description: Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00034.html; https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00034.html
CVE: CVE-2016-2140
Published: 2016-04-12
Description: The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/03/08/6; http://www.securityfocus.com/bid/84277; https://bugs.launchpad.net/nova/+bug/1548450
CVE: CVE-2016-2166
Published: 2016-04-12
Description: The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.html; http://packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.html; http://qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.html
CVE: CVE-2016-2170
Published: 2016-04-12
Description: Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://ofbiz.apache.org/download.html#vulnerabilities; http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html; http://www.securityfocus.com/archive/1/538034/100/0/threaded
CVE: CVE-2016-2556
Published: 2016-04-12
Description: The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows improperly allows access to restricted functionality, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4059; https://support.lenovo.com/us/en/product_security/len_5551; http://nvidia.custhelp.com/app/answers/detail/a_id/4059
CVE: CVE-2016-2557
Published: 2016-04-12
Description: The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information from kernel memory, cause a denial of service (crash), or possibly gain privileges via unspecified vectors, which trigger uninitialized or out-of-bounds memory access.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4060; https://support.lenovo.com/us/en/product_security/len_5551; http://nvidia.custhelp.com/app/answers/detail/a_id/4060
CVE: CVE-2016-2558
Published: 2016-04-12
Description: The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or gain privileges via unspecified vectors related to an untrusted pointer, which trigger uninitialized or out-of-bounds memory access.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4061; https://support.lenovo.com/us/en/product_security/len_5551; http://nvidia.custhelp.com/app/answers/detail/a_id/4061
CVE: CVE-2016-3162
Published: 2016-04-12
Description: The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3163
Published: 2016-04-12
Description: The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3164
Published: 2016-04-12
Description: Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
CVSS Score: 7.4 (HIGH)
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3165
Published: 2016-04-12
Description: The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3166
Published: 2016-04-12
Description: CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
CVSS Score: 5.9 (MEDIUM)
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3167
Published: 2016-04-12
Description: Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
CVSS Score: 7.4 (HIGH)
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3168
Published: 2016-04-12
Description: The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-254
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3169
Published: 2016-04-12
Description: The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3170
Published: 2016-04-12
Description: The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-3171
Published: 2016-04-12
Description: Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-19
References: http://www.debian.org/security/2016/dsa-3498; http://www.openwall.com/lists/oss-security/2016/02/24/19; http://www.openwall.com/lists/oss-security/2016/03/15/10
CVE: CVE-2016-0785
Published: 2016-04-12
Description: Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://struts.apache.org/docs/s2-029.html; http://www.securityfocus.com/bid/85066; http://www.securitytracker.com/id/1035271
CVE: CVE-2016-2162
Published: 2016-04-12
Description: Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://struts.apache.org/docs/s2-030.html; http://www.securityfocus.com/bid/85070; http://www.securitytracker.com/id/1035272
CVE: CVE-2016-3157
Published: 2016-04-12
Description: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2016/dsa-3607; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/84594