deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2360
Published: 2015-06-10
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-416
References: http://www.securityfocus.com/bid/75025; http://www.securitytracker.com/id/1032525; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-061
CVE: CVE-2015-3096
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3097
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144, and Adobe AIR SDK & Compiler before 18.0.0.144 on 64-bit Windows 7 systems do not properly select a random memory address for the Flash heap, which makes it easier for attackers to conduct unspecified attacks by predicting this address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/75090; http://www.securitytracker.com/id/1032519; http://www.securitytracker.com/id/1032810
CVE: CVE-2015-3098
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3099 and CVE-2015-3102.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3099
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3102.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3100
Published: 2015-06-10
Description: Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3101
Published: 2015-06-10
Description: The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/75089; http://www.securitytracker.com/id/1032519; https://helpx.adobe.com/security/products/flash-player/apsb15-11.html
CVE: CVE-2015-3102
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3099.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3103
Published: 2015-06-10
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3106 and CVE-2015-3107.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3104
Published: 2015-06-10
Description: Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3105
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3106
Published: 2015-06-10
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3107
Published: 2015-06-10
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3108
Published: 2015-06-10
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html
CVE: CVE-2015-3935
Published: 2015-06-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132108/Dolibarr-3.5-3.6-HTML-Injection.html; http://seclists.org/fulldisclosure/2015/May/126; http://www.securityfocus.com/bid/74926
CVE: CVE-2015-4415
Published: 2015-06-10
Description: Multiple directory traversal vulnerabilities in func.php in Magnifica Webscripts Anima Gallery 2.6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) theme or (2) lang cookie parameter to AnimaGallery/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/535705/100/0/threaded; http://www.securityfocus.com/bid/75061; http://www.securityfocus.com/archive/1/535705/100/0/threaded
CVE: CVE-2014-8603
Published: 2015-06-10
Description: cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/; http://www.vapid.dhs.org/advisory.php?v=110; http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
CVE: CVE-2014-8604
Published: 2015-06-10
Description: The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/; http://www.vapid.dhs.org/advisory.php?v=110; http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
CVE: CVE-2014-8605
Published: 2015-06-10
Description: The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/; http://www.vapid.dhs.org/advisory.php?v=110; http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
CVE: CVE-2014-8606
Published: 2015-06-10
Description: Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/; http://www.vapid.dhs.org/advisory.php?v=110; http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
CVE: CVE-2014-8607
Published: 2015-06-10
Description: The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/; http://www.vapid.dhs.org/advisory.php?v=110; http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
CVE: CVE-2015-3923
Published: 2015-06-10
Description: Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://forum.coppermine-gallery.net/index.php/topic%2C78194.0.html; http://packetstormsecurity.com/files/132004/Coppermine-Gallery-1.5.34-XSS-Open-Redirection.html; http://www.securityfocus.com/bid/75140
CVE: CVE-2015-4108
Published: 2015-06-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132179/Wing-FTP-4.4.6-Code-Execution-Cross-Site-Request-Forgery.html; http://packetstormsecurity.com/files/132180/Wing-FTP-4.4.6-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/535681/100/0/threaded
CVE: CVE-2015-4153
Published: 2015-06-10
Description: Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132172/WordPress-zM-Ajax-Login-Register-1.0.9-Local-File-Inclusion.html; http://www.securityfocus.com/archive/1/535682/100/0/threaded; http://www.securityfocus.com/bid/75041
CVE: CVE-2015-4171
Published: 2015-06-10
Description: strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html; http://www.debian.org/security/2015/dsa-3282; http://www.openwall.com/lists/oss-security/2015/05/29/6
CVE: CVE-2015-4465
Published: 2015-06-10
Description: Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/zm-ajax-login-register/changelog/; https://wordpress.org/plugins/zm-ajax-login-register/changelog/
CVE: CVE-2014-9732
Published: 2015-06-11
Description: The cabd_extract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive.
CVSS Score: 4.3 (MEDIUM)
References: http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72474; https://bugs.debian.org/774665
CVE: CVE-2015-4467
Published: 2015-06-11
Description: The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-division-by-zero.patch?id=a25bb144795e526748b57884daf365732c7e2295; http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72488
CVE: CVE-2015-4468
Published: 2015-06-11
Description: Multiple integer overflows in the search_chunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-pointer-arithmetic-overflow.patch?id=a25bb144795e526748b57884daf365732c7e2295; http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72486
CVE: CVE-2015-4469
Published: 2015-06-11
Description: The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-name-field-boundaries.patch?id=a25bb144795e526748b57884daf365732c7e2295; http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72486
CVE: CVE-2015-4470
Published: 2015-06-11
Description: Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72487; https://bugs.debian.org/775498
CVE: CVE-2015-4471
Published: 2015-06-11
Description: Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72492; https://bugs.debian.org/775499
CVE: CVE-2015-4472
Published: 2015-06-11
Description: Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://openwall.com/lists/oss-security/2015/02/03/11; http://www.securityfocus.com/bid/72490; https://bugs.debian.org/775687
CVE: CVE-2015-0737
Published: 2015-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38883; http://www.securitytracker.com/id/1032518; http://tools.cisco.com/security/center/viewAlert.x?alertId=38883
CVE: CVE-2015-0771
Published: 2015-06-12
Description: The IKE implementation in the WS-IPSEC-3 service module in Cisco IOS 12.2 on Catalyst 6500 devices allows remote authenticated users to cause a denial of service (device reload) by sending a crafted message during IPsec tunnel setup, aka Bug ID CSCur70505.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39233; http://www.securitytracker.com/id/1032517; http://tools.cisco.com/security/center/viewAlert.x?alertId=39233
CVE: CVE-2015-0773
Published: 2015-06-12
Description: Cisco FireSIGHT System Software 5.3.1.3 and 6.0.0 allows remote authenticated users to delete an arbitrary user's dashboard via a modified VPN deletion request in a management session, aka Bug ID CSCut67078.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39256; http://www.securitytracker.com/id/1032542; http://tools.cisco.com/security/center/viewAlert.x?alertId=39256
CVE: CVE-2015-0774
Published: 2015-06-12
Description: Cross-site scripting (XSS) vulnerability in Cisco Application and Content Networking System (ACNS) 5.5(9) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu70650.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39257; http://www.securitytracker.com/id/1032539; http://tools.cisco.com/security/center/viewAlert.x?alertId=39257
CVE: CVE-2015-0768
Published: 2015-06-12
Description: The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39192; http://www.securitytracker.com/id/1032541; http://tools.cisco.com/security/center/viewAlert.x?alertId=39192