deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0016
Published: 2016-01-13
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securitytracker.com/id/1034661; https://code.google.com/p/google-security-research/issues/detail?id=555; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007
CVE: CVE-2016-0018
Published: 2016-01-13
Description: Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: http://www.securitytracker.com/id/1034661; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007; http://www.securitytracker.com/id/1034661
CVE: CVE-2016-0019
Published: 2016-01-13
Description: The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511 allows remote attackers to bypass intended access restrictions and establish sessions for blank-password accounts via a modified RDP client, aka "Windows Remote Desktop Protocol Security Bypass Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-254
References: http://www.securitytracker.com/id/1034659; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007; http://www.securitytracker.com/id/1034659
CVE: CVE-2016-0020
Published: 2016-01-13
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "MAPI DLL Loading Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1034661; http://www.zerodayinitiative.com/advisories/ZDI-16-018; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007
CVE: CVE-2016-0024
Published: 2016-01-13
Description: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/79891; http://www.securitytracker.com/id/1034649; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-002
CVE: CVE-2016-0029
Published: 2016-01-13
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/79889; http://www.securitytracker.com/id/1034647; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010
CVE: CVE-2016-0030
Published: 2016-01-13
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/79890; http://www.securitytracker.com/id/1034647; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010
CVE: CVE-2016-0031
Published: 2016-01-13
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/79888; http://www.securitytracker.com/id/1034647; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010
CVE: CVE-2016-0032
Published: 2016-01-13
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/79884; http://www.securitytracker.com/id/1034647; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010
CVE: CVE-2016-0034
Published: 2016-01-13
Description: Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034655; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006; http://www.securitytracker.com/id/1034655
CVE: CVE-2016-0035
Published: 2016-01-13
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034651; http://www.zerodayinitiative.com/advisories/ZDI-15-639; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
CVE: CVE-2015-8466
Published: 2016-01-13
Description: Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174374.html; http://www.debian.org/security/2016/dsa-3583; https://bugs.launchpad.net/swift3/+bug/1497424
CVE: CVE-2015-8607
Published: 2016-01-13
Description: The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://cpansearch.perl.org/src/RJBS/PathTools-3.62/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175494.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176228.html
CVE: CVE-2016-1494
Published: 2016-01-13
Description: The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175897.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175942.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00032.html
CVE: CVE-2016-1569
Published: 2016-01-13
Description: FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.html; http://sourceforge.net/p/firebird/code/62783/; http://tracker.firebirdsql.org/browse/CORE-5068
CVE: CVE-2016-0931
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FileAttachment annotation, a different vulnerability than CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-009; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0932
Published: 2016-01-14
Description: Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0934, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-008; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0933
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1217
CVE: CVE-2016-0934
Published: 2016-01-14
Description: Use-after-free vulnerability in AGM.dll in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2016-0932, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-016; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0935
Published: 2016-01-14
Description: Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted ExtGState dictionary.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-017; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0936
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG 2000 data, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-014; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0937
Published: 2016-01-14
Description: Use-after-free vulnerability in the OCG object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0940, and CVE-2016-0941.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-011; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0938
Published: 2016-01-14
Description: The AcroForm plugin in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-013; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0939
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-015; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0940
Published: 2016-01-14
Description: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0941.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2016-0941
Published: 2016-01-14
Description: Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0940.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-010; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0942
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2016-0943
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X mishandle the Global object, which allows attackers to bypass JavaScript API execution restrictions via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034646; http://zerodayinitiative.com/advisories/ZDI-16-012; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html
CVE: CVE-2016-0944
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0945, and CVE-2016-0946.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2016-0945
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, and CVE-2016-0946.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2016-0946
Published: 2016-01-14
Description: Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, and CVE-2016-0945.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2016-0947
Published: 2016-01-14
Description: Untrusted search path vulnerability in Adobe Download Manager, as used in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allows local users to gain privileges via a crafted resource in an unspecified directory.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1034646; https://helpx.adobe.com/security/products/acrobat/apsb16-02.html; http://www.securitytracker.com/id/1034646
CVE: CVE-2015-8605
Published: 2016-01-14
Description: ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175594.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176031.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00162.html
CVE: CVE-2016-0777
Published: 2016-01-14
Description: The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734; http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html
CVE: CVE-2016-0778
Published: 2016-01-14
Description: The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734; http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html
CVE: CVE-2015-3943
Published: 2016-01-15
Description: Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2015-3946
Published: 2016-01-15
Description: Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2015-3947
Published: 2016-01-15
Description: SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2015-3948
Published: 2016-01-15
Description: Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2015-5007
Published: 2016-01-15
Description: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 8 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54267; http://www-01.ibm.com/support/docview.wss?uid=swg1JR54268; http://www-01.ibm.com/support/docview.wss?uid=swg21972611
CVE: CVE-2015-6314
Published: 2016-01-15
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors, aka Bug ID CSCuw06153.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-wlc; http://www.securitytracker.com/id/1034665; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-wlc