deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4321
Published: 2015-08-20
Description: The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote attackers to bypass uRPF validation via spoofed packets, aka Bug ID CSCuv60724.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40440; http://www.securitytracker.com/id/1033265; http://tools.cisco.com/security/center/viewAlert.x?alertId=40440
CVE: CVE-2015-4329
Published: 2015-08-20
Description: The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40523; http://www.securityfocus.com/bid/76395; http://www.securitytracker.com/id/1033329
CVE: CVE-2015-4530
Published: 2015-08-20
Description: Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the authentication of arbitrary users.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2518.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/bugtraq/2015/Aug/87; http://www.securityfocus.com/bid/76405; http://seclists.org/bugtraq/2015/Aug/87
CVE: CVE-2015-4531
Published: 2015-08-20
Description: EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data access and server actions, via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4622.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76413; http://seclists.org/bugtraq/2015/Aug/86
CVE: CVE-2015-4532
Published: 2015-08-20
Description: EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently execute arbitrary code, via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2514.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76414; http://seclists.org/bugtraq/2015/Aug/86
CVE: CVE-2015-4533
Published: 2015-08-20
Description: EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76411; http://www.securitytracker.com/id/1033296
CVE: CVE-2015-4534
Published: 2015-08-20
Description: Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the method_verb parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76410; http://www.securitytracker.com/id/1033296
CVE: CVE-2015-4535
Published: 2015-08-20
Description: Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing a login ticket.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76409; http://www.securitytracker.com/id/1033296
CVE: CVE-2015-4536
Published: 2015-08-20
Description: EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://seclists.org/bugtraq/2015/Aug/86; http://www.securityfocus.com/bid/76412; http://www.securitytracker.com/id/1033296
CVE: CVE-2015-4318
Published: 2015-08-20
Description: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40443; http://www.securityfocus.com/bid/76347; http://www.securitytracker.com/id/1033281
CVE: CVE-2015-3219
Published: 2015-08-20
Description: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.openstack.org/pipermail/openstack-announce/2015-June/000361.html; http://rhn.redhat.com/errata/RHSA-2015-1679.html; http://www.debian.org/security/2016/dsa-3617
CVE: CVE-2015-6528
Published: 2015-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133059/Coppermine-Photo-Gallery-1.5.36-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/133059/Coppermine-Photo-Gallery-1.5.36-Cross-Site-Scripting.html
CVE: CVE-2015-6529
Published: 2015-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-PHPIPAM0812.txt; http://packetstormsecurity.com/files/133055/phpipam-1.1.010-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536188/100/0/threaded
CVE: CVE-2015-6530
Published: 2015-08-20
Description: Cross-site scripting (XSS) vulnerability in OpenText Secure MFT 2013 before 2013 R3 P6 and 2014 before 2014 R2 P2 allows remote attackers to inject arbitrary web script or HTML via the querytext parameter to userdashboard.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133247/OpenText-Secure-MFT-2014-R2-SP4-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536260/100/0/threaded; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-041.txt
CVE: CVE-2015-5192
Published: 2015-08-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-5195.  Reason: This candidate is a reservation duplicate of CVE-2015-5195.  Notes: All CVE users should reference CVE-2015-5195 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-5193
Published: 2015-08-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-7703.  Reason: This candidate is a reservation duplicate of CVE-2015-7703.  Notes: All CVE users should reference CVE-2015-7703 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-4331
Published: 2015-08-22
Description: Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40553; http://www.securitytracker.com/id/1033356; http://tools.cisco.com/security/center/viewAlert.x?alertId=40553
CVE: CVE-2015-6256
Published: 2015-08-22
Description: Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets, aka Bug ID CSCuv62820.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40585; http://www.securitytracker.com/id/1033355; http://tools.cisco.com/security/center/viewAlert.x?alertId=40585
CVE: CVE-2015-6258
Published: 2015-08-22
Description: The Internet Access Point Protocol (IAPP) module on Cisco Wireless LAN Controller (WLC) devices with software 8.1(104.37) allows remote attackers to trigger incorrect traffic forwarding via crafted IPv6 packets, aka Bug ID CSCuv40033.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40586; http://www.securitytracker.com/id/1033360; http://tools.cisco.com/security/center/viewAlert.x?alertId=40586
CVE: CVE-2015-2984
Published: 2015-08-22
Description: I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN17964918/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000117; http://www.iodata.jp/support/information/2015/wn-g54r2/
CVE: CVE-2015-4537
Published: 2015-08-22
Description: Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://seclists.org/bugtraq/2015/Aug/117; http://www.securitytracker.com/id/1033345; http://seclists.org/bugtraq/2015/Aug/117
CVE: CVE-2015-2982
Published: 2015-08-22
Description: Cross-site scripting (XSS) vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN69175956/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000113; http://www.php-factory.net/trivia/16.php
CVE: CVE-2015-2983
Published: 2015-08-22
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN78240242/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000114; http://www.php-factory.net/trivia/16.php
CVE: CVE-2014-1972
Published: 2015-08-22
Description: Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN17611367/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000118; http://seclists.org/fulldisclosure/2019/Aug/20
CVE: CVE-2015-1932
Published: 2015-08-22
Description: IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI38403; http://www-01.ibm.com/support/docview.wss?uid=swg21963275; http://www.securityfocus.com/bid/76466
CVE: CVE-2015-2132
Published: 2015-08-22
Description: Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
CVSS Score: 4.4 (MEDIUM)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04735247; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04735247
CVE: CVE-2015-2137
Published: 2015-08-22
Description: Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1033260; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762687; http://www.securitytracker.com/id/1033260
CVE: CVE-2015-4938
Published: 2015-08-22
Description: IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI37396; http://www-01.ibm.com/support/docview.wss?uid=swg21963275; http://www.securityfocus.com/bid/76463
CVE: CVE-2015-5406
Published: 2015-08-22
Description: HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5407 and CVE-2015-5408.
CVSS Score: 9.0 (HIGH)
References: http://www.securityfocus.com/bid/76359; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04751893; http://www.securityfocus.com/bid/76359
CVE: CVE-2015-5407
Published: 2015-08-22
Description: HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5408.
CVSS Score: 6.0 (MEDIUM)
References: http://www.securityfocus.com/bid/76356; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04751893; http://www.securityfocus.com/bid/76356
CVE: CVE-2015-5408
Published: 2015-08-22
Description: HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5407.
CVSS Score: 6.0 (MEDIUM)
References: http://www.securityfocus.com/bid/76356; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04751893; http://www.securityfocus.com/bid/76356
CVE: CVE-2015-2014
Published: 2015-08-23
Description: Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.
CVSS Score: 5.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963016; http://www.securitytracker.com/id/1033271; http://www-01.ibm.com/support/docview.wss?uid=swg21963016
CVE: CVE-2015-2015
Published: 2015-08-23
Description: Cross-site scripting (XSS) vulnerability in pubnames.ntf (aka the Directory template) in the web server in IBM Domino before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH8WBPRN.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963016; http://www.securitytracker.com/id/1033271; http://www-01.ibm.com/support/docview.wss?uid=swg21963016
CVE: CVE-2015-4949
Published: 2015-08-23
Description: IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows, a different vulnerability than CVE-2015-6557.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480; http://www-01.ibm.com/support/docview.wss?uid=swg21963630; http://www.securitytracker.com/id/1033270
CVE: CVE-2015-6557
Published: 2015-08-23
Description: IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480; http://www-01.ibm.com/support/docview.wss?uid=swg21963630; http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480
CVE: CVE-2015-1992
Published: 2015-08-23
Description: IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=nas7d9a0db411a9071e986257e8c0029b365; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08185; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098524
CVE: CVE-2015-4950
Published: 2015-08-23
Description: The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected, which allows remote authenticated users to obtain sensitive information via a duplicate alias name.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT04251; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04252; http://www-01.ibm.com/support/docview.wss?uid=swg21963629
CVE: CVE-2015-2018
Published: 2015-08-23
Description: IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT07773; http://www-01.ibm.com/support/docview.wss?uid=swg21961734; http://www-01.ibm.com/support/docview.wss?uid=swg1IT07773
CVE: CVE-2015-2872
Published: 2015-08-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://esupport.trendmicro.com/solution/en-US/1112206.aspx; http://www.kb.cert.org/vuls/id/248692; http://www.securityfocus.com/bid/76397
CVE: CVE-2015-2873
Published: 2015-08-23
Description: Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-425
References: http://esupport.trendmicro.com/solution/en-US/1112206.aspx; http://www.kb.cert.org/vuls/id/248692; http://www.securityfocus.com/bid/76396
CVE: CVE-2015-2904
Published: 2015-08-23
Description: Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface.
CVSS Score: 8.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/335192; http://www.kb.cert.org/vuls/id/335192
CVE: CVE-2015-2905
Published: 2015-08-23
Description: Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/335192; http://www.kb.cert.org/vuls/id/335192
CVE: CVE-2015-2906
Published: 2015-08-23
Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation.
CVSS Score: 9.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/209512; https://www.usenix.org/conference/woot15/workshop-program/presentation/foster; http://www.kb.cert.org/vuls/id/209512