deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0701
Published: 2015-05-07
Description: Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150506-ucsc; http://www.securityfocus.com/bid/74491; http://www.securitytracker.com/id/1032267
CVE: CVE-2015-0715
Published: 2015-05-07
Description: SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCut33447 and CSCut33608.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38674; http://www.securitytracker.com/id/1032260; http://tools.cisco.com/security/center/viewAlert.x?alertId=38674
CVE: CVE-2015-0716
Published: 2015-05-07
Description: Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut33659.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38675; http://www.securitytracker.com/id/1032259; http://tools.cisco.com/security/center/viewAlert.x?alertId=38675
CVE: CVE-2015-3610
Published: 2015-05-07
Description: The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311412.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-311412.pdf
CVE: CVE-2015-1152
Published: 2015-05-08
Description: WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1153 and CVE-2015-1154.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html; http://lists.apple.com/archives/security-announce/2015/May/msg00000.html
CVE: CVE-2015-1153
Published: 2015-05-08
Description: WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html; http://lists.apple.com/archives/security-announce/2015/May/msg00000.html
CVE: CVE-2015-1154
Published: 2015-05-08
Description: WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html; http://lists.apple.com/archives/security-announce/2015/May/msg00000.html; http://www.securityfocus.com/bid/74526
CVE: CVE-2015-1155
Published: 2015-05-08
Description: The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/May/msg00000.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
CVE: CVE-2015-1156
Published: 2015-05-08
Description: The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/May/msg00000.html; http://support.apple.com/kb/HT204941
CVE: CVE-2014-0919
Published: 2015-05-08
Description: IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT07397; http://www-01.ibm.com/support/docview.wss?uid=swg1IT07547; http://www-01.ibm.com/support/docview.wss?uid=swg1IT07552
CVE: CVE-2015-1907
Published: 2015-05-08
Description: The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4 before 8.1.4.7 allows remote authenticated users to read cookies via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21882666; http://www.securityfocus.com/bid/74552; http://www.securitytracker.com/id/1032257
CVE: CVE-2014-9716
Published: 2015-05-08
Description: Cross-site scripting (XSS) vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74577; https://github.com/kogmbh/WebODF/blob/master/ChangeLog.md; https://github.com/kogmbh/WebODF/pull/851
CVE: CVE-2015-2347
Published: 2015-05-08
Description: Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131460/Huawei-SEQ-Analyst-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Apr/43; http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/hw-424267.htm
CVE: CVE-2015-3011
Published: 2015-05-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted contact.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.debian.org/security/2015/dsa-3244; http://www.securityfocus.com/bid/74445; https://owncloud.org/security/advisory/?id=oc-sa-2015-001
CVE: CVE-2015-3012
Published: 2015-05-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a (1) style or (2) font name or (3) javascript or (4) data URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2015/dsa-3244; http://www.securityfocus.com/bid/74445; https://github.com/kogmbh/WebODF/blob/master/ChangeLog.md
CVE: CVE-2015-3013
Published: 2015-05-08
Description: ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-74
References: http://www.debian.org/security/2015/dsa-3244; http://www.securityfocus.com/bid/74451; https://owncloud.org/security/advisory/?id=oc-sa-2015-003
CVE: CVE-2015-3294
Published: 2015-05-08
Description: The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00013.html; http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html; http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009387.html
CVE: CVE-2014-8616
Published: 2015-05-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-15-005/; http://www.securitytracker.com/id/1032261; http://www.securitytracker.com/id/1032262
CVE: CVE-2014-8618
Published: 2015-05-12
Description: Cross-site scripting (XSS) vulnerability in the theme login page in Fortinet FortiADC D models before 4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-15-005/; http://www.securitytracker.com/id/1032265; http://www.fortiguard.com/advisory/FG-IR-15-005/
CVE: CVE-2014-8619
Published: 2015-05-12
Description: Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-15-005/; http://www.securitytracker.com/id/1032307; http://www.fortiguard.com/advisory/FG-IR-15-005/
CVE: CVE-2014-9326
Published: 2015-05-12
Description: The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securitytracker.com/id/1032305; https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16090.html; http://www.securitytracker.com/id/1032305
CVE: CVE-2015-1858
Published: 2015-05-12
Description: Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html
CVE: CVE-2015-1859
Published: 2015-05-12
Description: Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html
CVE: CVE-2015-1860
Published: 2015-05-12
Description: Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155947.html
CVE: CVE-2015-1880
Published: 2015-05-12
Description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-15-005/; http://www.securityfocus.com/bid/74652; http://www.securitytracker.com/id/1032261
CVE: CVE-2015-2170
Published: 2015-05-12
Description: The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html; http://ubuntu.com/usn/usn-2594-1
CVE: CVE-2015-2219
Published: 2015-05-12
Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://securitytracker.com/id/1032268; http://support.lenovo.com/us/en/product_security/lsu_privilege; http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
CVE: CVE-2015-2221
Published: 2015-05-12
Description: ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html; http://ubuntu.com/usn/usn-2594-1
CVE: CVE-2015-2222
Published: 2015-05-12
Description: ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html; http://ubuntu.com/usn/usn-2594-1
CVE: CVE-2015-2233
Published: 2015-05-12
Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
CVSS Score: 8.3 (HIGH)
CWE: CWE-310
References: http://securitytracker.com/id/1032268; http://support.lenovo.com/us/en/product_security/lsu_privilege; http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
CVE: CVE-2015-2234
Published: 2015-05-12
Description: Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://securitytracker.com/id/1032268; http://support.lenovo.com/us/en/product_security/lsu_privilege; http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
CVE: CVE-2015-2668
Published: 2015-05-12
Description: ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html; http://ubuntu.com/usn/usn-2594-1
CVE: CVE-2015-2829
Published: 2015-05-12
Description: Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://support.citrix.com/article/CTX200861; http://www.securityfocus.com/bid/74473; http://www.securitytracker.com/id/1032242
CVE: CVE-2015-2842
Published: 2015-05-12
Description: Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3[PII_REDACTED] allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in sounds/.
CVSS Score: 10.0 (HIGH)
References: http://goautodial.org/news/21; http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html; http://www.securityfocus.com/archive/1/535319/100/1100/threaded
CVE: CVE-2015-2843
Published: 2015-05-12
Description: Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3[PII_REDACTED] allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://goautodial.org/news/21; http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html; http://www.securityfocus.com/archive/1/535319/100/1100/threaded
CVE: CVE-2015-2844
Published: 2015-05-12
Description: The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3[PII_REDACTED] allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://goautodial.org/news/21; http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html; http://www.securityfocus.com/archive/1/535319/100/1100/threaded
CVE: CVE-2015-2845
Published: 2015-05-12
Description: The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3[PII_REDACTED] allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://goautodial.org/news/21; http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html; http://www.securityfocus.com/archive/1/535319/100/1100/threaded
CVE: CVE-2015-3451
Published: 2015-05-12
Description: The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611
References: http://advisories.mageia.org/MGASA-2015-0199.html; http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html
CVE: CVE-2015-3620
Published: 2015-05-12
Description: Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/May/13; http://www.fortiguard.com/advisory/FG-IR-15-005/
CVE: CVE-2015-3622
Published: 2015-05-12
Description: The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158225.html; http://lists.opensuse.org/opensuse-updates/2015-08/msg00014.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html
CVE: CVE-2015-3646
Published: 2015-05-12
Description: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74456
CVE: CVE-2015-3978
Published: 2015-05-12
Description: SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/; http://www.securityfocus.com/bid/74625; http://www.securitytracker.com/id/1032310
CVE: CVE-2015-3979
Published: 2015-05-12
Description: Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
CVSS Score: 7.5 (HIGH)
References: http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/; http://www.securityfocus.com/bid/74626; http://www.securitytracker.com/id/1032309
CVE: CVE-2015-3980
Published: 2015-05-12
Description: SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition/; http://www.securityfocus.com/bid/74624; http://www.securitytracker.com/id/1032309
CVE: CVE-2015-3981
Published: 2015-05-12
Description: SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/74627; http://www.securitytracker.com/id/1032308; https://erpscan.io/press-center/blog/sap-security-notes-april-2015/
CVE: CVE-2014-9160
Published: 2015-05-13
Description: Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1032284; https://helpx.adobe.com/security/products/reader/apsb15-10.html; http://www.securitytracker.com/id/1032284
CVE: CVE-2015-1658
Published: 2015-05-13
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1706, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/74504; http://www.securitytracker.com/id/1032282; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043