deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3425
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html
CVE: CVE-2016-3426
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.
CVSS Score: 3.1 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html
CVE: CVE-2016-3427
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html
CVE: CVE-2016-3428
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect availability via vectors related to Engineering Communication Interface.
CVSS Score: 3.1 (LOW)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035591; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3429
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Retail Xstore Point of Service component in Oracle Retail Applications 5.0, 5.5, 6.0, 6.5, 7.0, and 7.1 allows remote authenticated users to affect confidentiality and integrity via vectors related to Xstore Services.
CVSS Score: 4.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035600; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3431
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.1.1, 9.3.1.2, 9.3.2, and 9.3.3 allows remote authenticated users to affect confidentiality and integrity via vectors related to Security, a different vulnerability than CVE-2016-3420.
CVSS Score: 6.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035591; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3434
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout.
CVSS Score: 4.7 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3435
Published: 2016-04-21
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect availability via vectors related to PIA Core Technology.
CVSS Score: 4.7 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035610; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3436
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Tasks.
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; https://www.onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3436
CVE: CVE-2016-3437
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Person Address Page.
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; https://www.onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3437
CVE: CVE-2016-3438
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.
CVSS Score: 8.2 (HIGH)
References: http://onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3438; http://packetstormsecurity.com/files/138564/Oracle-E-Business-Suite-12.2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/Aug/136
CVE: CVE-2016-3439
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Call Phone Number Page.
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; https://www.onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3439
CVE: CVE-2016-3441
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect confidentiality, integrity, and availability via vectors related to Filesystem.
CVSS Score: 7.8 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035629; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3442
Published: 2016-04-21
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Portal.
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035610; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3443
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.  NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read.
CVSS Score: 9.6 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
CVE: CVE-2016-3447
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to OAF Core.
CVSS Score: 6.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3449
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.
CVSS Score: 8.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
CVE: CVE-2016-3454
Published: 2016-04-21
Description: Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 9.0 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035590; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3455
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters.
CVSS Score: 8.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securityfocus.com/bid/86437; http://www.securitytracker.com/id/1035618
CVE: CVE-2016-3456
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul component in Oracle Supply Chain Products Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Dialog Box.
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035591; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3457
Published: 2016-04-21
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM ePerformance component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Security.
CVSS Score: 4.6 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035610; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3460
Published: 2016-04-21
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to ePerformance.
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035610; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3461
Published: 2016-04-21
Description: Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to affect confidentiality, integrity, and availability via vectors related to Monitoring: Server.
CVSS Score: 7.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035606; https://www.tenable.com/security/research/tra-2016-11
CVE: CVE-2016-3462
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Network Configuration Service.
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035629; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3463
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to Pre-Login.
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035604; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3464
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.3 allows remote authenticated users to affect confidentiality via vectors related to Accounts.
CVSS Score: 5.7 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035604; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3465
Published: 2016-04-21
Description: Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect availability via vectors related to ZFS.
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035629; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-3466
Published: 2016-04-21
Description: Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless.
CVSS Score: 9.1 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html; http://www.securitytracker.com/id/1035603; http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
CVE: CVE-2016-6479
Published: 2016-04-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-6479.  Reason: This candidate is a duplicate of CVE-2015-6479.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2015-6479 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-7449
Published: 2016-04-21
Description: The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://hexchat.readthedocs.org/en/latest/changelog.html; http://www.ubuntu.com/usn/USN-2945-1; https://bugzilla.redhat.com/show_bug.cgi?id=1081839
CVE: CVE-2016-3190
Published: 2016-04-21
Description: The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-04/msg00029.html; https://bugzilla.redhat.com/show_bug.cgi?id=1318977; https://cgit.freedesktop.org/cairo/patch/src/cairo-image-compositor.c?id=5c82d91a5e15d29b1489dcb413b24ee7fdf59934
CVE: CVE-2016-3977
Published: 2016-04-21
Description: Heap-based buffer overflow in util/gif2rgb.c in gif2rgb in giflib 5.1.2 allows remote attackers to cause a denial of service (application crash) via the background color index in a GIF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://bugs.fi/fuzzing/index.html; http://lists.opensuse.org/opensuse-updates/2016-04/msg00079.html; http://lists.opensuse.org/opensuse-updates/2016-04/msg00084.html
CVE: CVE-2016-2299
Published: 2016-04-22
Description: SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: http://www.zerodayinitiative.com/advisories/ZDI-16-236; http://www.zerodayinitiative.com/advisories/ZDI-16-237; http://www.zerodayinitiative.com/advisories/ZDI-16-238
CVE: CVE-2016-2300
Published: 2016-04-22
Description: Ecava IntegraXor before 5.0 build 4522 allows remote attackers to bypass authentication and access unspecified web pages via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2301
Published: 2016-04-22
Description: SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2302
Published: 2016-04-22
Description: Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2303
Published: 2016-04-22
Description: CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 5.3 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2304
Published: 2016-04-22
Description: Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2305
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2306
Published: 2016-04-22
Description: The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE: CVE-2016-2354
Published: 2016-04-22
Description: The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.kb.cert.org/vuls/id/615456; http://www.kb.cert.org/vuls/id/615456
CVE: CVE-2016-3145
Published: 2016-04-22
Description: Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase Printer Memory and Erase Hard Disk actions, which allows physically proximate attackers to obtain sensitive information via direct read operations on non-volatile memory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://support.lexmark.com/index?page=content&id=TE760; http://support.lexmark.com/index?page=content&id=TE760
CVE: CVE-2016-1593
Published: 2016-04-22
Description: Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/136717/Novell-ServiceDesk-Authenticated-File-Upload.html; http://www.rapid7.com/db/modules/exploit/multi/http/novell_servicedesk_rce; http://www.securityfocus.com/archive/1/538043/100/0/threaded
CVE: CVE-2016-1594
Published: 2016-04-22
Description: Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/538043/100/0/threaded; https://packetstormsecurity.com/files/136646; https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
CVE: CVE-2016-1595
Published: 2016-04-22
Description: LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language (HQL) injection attacks and obtain sensitive information via the entityName parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/538043/100/0/threaded; https://packetstormsecurity.com/files/136646; https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
CVE: CVE-2016-1596
Published: 2016-04-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain (1) user name, (2) tf_aClientFirstName, (3) tf_aClientLastName, (4) ta_selectedTopicContent, (5) tf_orgUnitName, (6) tf_aManufacturerFullName, (7) tf_aManufacturerName, (8) tf_aManufacturerAddress, or (9) tf_aManufacturerCity parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/538043/100/0/threaded; https://packetstormsecurity.com/files/136646; https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
CVE: CVE-2016-4059
Published: 2016-04-22
Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/85379; http://www.zerodayinitiative.com/advisories/ZDI-16-221; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2016-4060
Published: 2016-04-22
Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/85379; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/85379