deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1845
Published: 2015-05-19
Description: Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/04/01/5; http://www.securityfocus.com/bid/73693; http://www.securitytracker.com/id/1032011
CVE: CVE-2015-1846
Published: 2015-05-19
Description: unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2015/04/01/5; http://www.securityfocus.com/bid/73686; http://www.securitytracker.com/id/1032011
CVE: CVE-2015-3407
Published: 2015-05-19
Description: Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://ubuntu.com/usn/usn-2607-1; http://www.debian.org/security/2015/dsa-3261; http://www.openwall.com/lists/oss-security/2015/04/07/1
CVE: CVE-2015-3408
Published: 2015-05-19
Description: Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://ubuntu.com/usn/usn-2607-1; http://www.debian.org/security/2015/dsa-3261; http://www.openwall.com/lists/oss-security/2015/04/07/1
CVE: CVE-2015-3409
Published: 2015-05-19
Description: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.
CVSS Score: 7.2 (HIGH)
References: http://ubuntu.com/usn/usn-2607-1; http://www.debian.org/security/2015/dsa-3261; http://www.openwall.com/lists/oss-security/2015/04/07/1
CVE: CVE-2015-3885
Published: 2015-05-19
Description: Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162084.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159469.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159479.html
CVE: CVE-2015-3988
Published: 2015-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2015-1679.html; http://www.openwall.com/lists/oss-security/2015/05/12/9; http://www.openwall.com/lists/oss-security/2015/05/14/14
CVE: CVE-2015-0740
Published: 2015-05-20
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38913; http://www.securityfocus.com/bid/74732; http://www.securitytracker.com/id/1032367
CVE: CVE-2015-1920
Published: 2015-05-20
Description: IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.
CVSS Score: 10.0 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI38302; http://www-01.ibm.com/support/docview.wss?uid=swg21883573; http://www.securityfocus.com/bid/74439
CVE: CVE-2014-6211
Published: 2015-05-20
Description: The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when debugging is configured, do not properly restrict the logging of personal data, which allows local users to obtain sensitive information by reading a log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52117; http://www-01.ibm.com/support/docview.wss?uid=swg1JR52983; http://www-01.ibm.com/support/docview.wss?uid=swg21883875
CVE: CVE-2014-4776
Published: 2015-05-20
Description: IBM License Metric Tool 9 before 9.1.0.2 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21713641; http://www.securityfocus.com/bid/74437; http://www.securitytracker.com/id/1032256
CVE: CVE-2014-8924
Published: 2015-05-20
Description: The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 6.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21882820; http://www.securitytracker.com/id/1032275; http://www-01.ibm.com/support/docview.wss?uid=swg21882820
CVE: CVE-2015-0189
Published: 2015-05-20
Description: The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwrite and daemon outage) by triggering multiple transmit-queue records.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05869; http://www-01.ibm.com/support/docview.wss?uid=swg21883457; http://www.securityfocus.com/bid/74706
CVE: CVE-2015-1251
Published: 2015-05-20
Description: Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
CVSS Score: 6.8 (MEDIUM)
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html
CVE: CVE-2015-1252
Published: 2015-05-20
Description: common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1253
Published: 2015-05-20
Description: core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1254
Published: 2015-05-20
Description: core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1255
Published: 2015-05-20
Description: Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1256
Published: 2015-05-20
Description: Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1257
Published: 2015-05-20
Description: platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1258
Published: 2015-05-20
Description: Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168803.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166975.html
CVE: CVE-2015-1259
Published: 2015-05-20
Description: PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1260
Published: 2015-05-20
Description: Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1261
Published: 2015-05-20
Description: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1262
Published: 2015-05-20
Description: platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1263
Published: 2015-05-20
Description: The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1264
Published: 2015-05-20
Description: Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1265
Published: 2015-05-20
Description: Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
CVE: CVE-2015-1902
Published: 2015-05-20
Description: Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21883245; http://www.securityfocus.com/bid/74597; http://www.securitytracker.com/id/1032376
CVE: CVE-2015-1903
Published: 2015-05-20
Description: Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSN3Y.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21883245; http://www.securityfocus.com/bid/74598; http://www.securitytracker.com/id/1032376
CVE: CVE-2015-3910
Published: 2015-05-20
Description: Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html; http://www.securityfocus.com/bid/74730
CVE: CVE-2012-1664
Published: 2015-05-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html; http://bugtrack.oscmax.com/view.php?id=1165; http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
CVE: CVE-2012-1665
Published: 2015-05-20
Description: Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html; http://bugtrack.oscmax.com/view.php?id=1165; http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update
CVE: CVE-2012-3243
Published: 2015-05-20
Description: Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/53927; http://www.securityfocus.com/bid/53927
CVE: CVE-2012-6691
Published: 2015-05-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0021.html; http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update; http://www.securityfocus.com/bid/74753
CVE: CVE-2015-1188
Published: 2015-05-20
Description: The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2015/Apr/103; http://seclists.org/fulldisclosure/2015/Apr/103
CVE: CVE-2015-3990
Published: 2015-05-20
Description: The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
CVSS Score: 9.0 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/74756; http://www.securitytracker.com/id/1032373; http://www.zerodayinitiative.com/advisories/ZDI-15-231/
CVE: CVE-2015-3999
Published: 2015-05-20
Description: Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2015/May/72; http://www.securityfocus.com/bid/74714; http://seclists.org/fulldisclosure/2015/May/72
CVE: CVE-2015-4016
Published: 2015-05-20
Description: The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://store.steampowered.com/news/16801/; http://www.securityfocus.com/bid/74735; http://www.zerodayinitiative.com/advisories/ZDI-15-233/
CVE: CVE-2012-4901
Published: 2015-05-20
Description: Cross-site scripting (XSS) vulnerability in Template CMS 2.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the themes_editor parameter in an add_template action to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/85895; http://www.securityfocus.com/bid/55766; https://www.exploit-db.com/exploits/21742/
CVE: CVE-2012-4902
Published: 2015-05-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an add action to admin/index.php or (2) conduct static PHP code injection attacks via the themes_editor parameter in an edit_template action to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/85896; http://www.securityfocus.com/bid/55766; https://www.exploit-db.com/exploits/21742/
CVE: CVE-2015-3141
Published: 2015-05-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/121847; http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/74578
CVE: CVE-2015-4000
Published: 2015-05-21
Description: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-310
References: http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc; http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc