deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7998
Published: 2015-11-17
Description: The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://support.citrix.com/article/CTX202482; http://www.securitytracker.com/id/1034167; http://support.citrix.com/article/CTX202482
CVE: CVE-2015-8220
Published: 2015-11-17
Description: Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-555; https://thwack.solarwinds.com/message/308973; http://www.zerodayinitiative.com/advisories/ZDI-15-555
CVE: CVE-2015-8221
Published: 2015-11-17
Description: Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119, CWE-189
References: http://packetstormsecurity.com/files/134315/Google-Picasa-CAMF-Section-Integer-Overflow.html; http://secunia.com/secunia_research/2015-5/; http://www.securityfocus.com/archive/1/536878/100/0/threaded
CVE: CVE-2015-8222
Published: 2015-11-17
Description: The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2809-1; https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1515689; https://github.com/lxc/lxd/issues/1307
CVE: CVE-2015-8232
Published: 2015-11-17
Description: The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2612812; https://www.drupal.org/node/2613444; https://www.drupal.org/node/2612812
CVE: CVE-2015-8233
Published: 2015-11-17
Description: Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2613046; https://www.drupal.org/node/2613048; https://www.drupal.org/node/2613424
CVE: CVE-2015-6330
Published: 2015-11-18
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus62712.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151008-pca1; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151008-pca1
CVE: CVE-2015-6357
Published: 2015-11-18
Description: The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/134390/Cisco-FireSIGHT-Management-Center-Certificate-Validation.html; http://seclists.org/fulldisclosure/2015/Nov/79; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fmc
CVE: CVE-2015-6847
Published: 2015-11-18
Description: The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/134420/EMC-VPLEX-Sensitive-Information-Exposure.html; http://seclists.org/bugtraq/2015/Nov/92; http://www.securitytracker.com/id/1034169
CVE: CVE-2015-4852
Published: 2015-11-18
Description: The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/; http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html; http://www.openwall.com/lists/oss-security/2015/11/17/19
CVE: CVE-2015-6372
Published: 2015-11-18
Description: Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower2; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower2
CVE: CVE-2015-6373
Published: 2015-11-18
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower3; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower3
CVE: CVE-2015-5253
Published: 2015-11-18
Description: The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc; http://rhn.redhat.com/errata/RHSA-2016-0321.html; http://www.openwall.com/lists/oss-security/2015/11/14/1
CVE: CVE-2015-5999
Published: 2015-11-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-816L/DIR-816L_REVB_FIRMWARE_PATCH_NOTES_2.06.B09_BETA_EN.PDF; http://packetstormsecurity.com/files/134379/D-Link-DIR-816L-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2015/Nov/45
CVE: CVE-2015-7941
Published: 2015-11-18
Description: libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
CVE: CVE-2015-7942
Published: 2015-11-18
Description: The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
CVE: CVE-2015-8023
Published: 2015-11-18
Description: The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html; http://www.debian.org/security/2015/dsa-3398
CVE: CVE-2015-8035
Published: 2015-11-18
Description: The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
CVSS Score: 2.6 (LOW)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
CVE: CVE-2015-5255
Published: 2015-11-18
Description: Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0108&w=2; http://packetstormsecurity.com/files/134506/Apache-Flex-BlazeDS-4.7.1-SSRF.html; http://www.securityfocus.com/archive/1/536958/100/0/threaded
CVE: CVE-2015-8051
Published: 2015-11-18
Description: The Adobe Premiere Clip app before 1.2.1 for iOS mishandles unspecified input, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/fulldisclosure/2015/Nov/81; http://www.securityfocus.com/archive/1/536928/100/0/threaded; http://www.securityfocus.com/bid/77624
CVE: CVE-2015-8052
Published: 2015-11-18
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/77625; http://www.securitytracker.com/id/1034211; https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
CVE: CVE-2015-8053
Published: 2015-11-18
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/77625; http://www.securitytracker.com/id/1034211; https://helpx.adobe.com/security/products/coldfusion/apsb15-29.html
CVE: CVE-2015-8090
Published: 2015-11-18
Description: The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain sensitive information, via an HTTP request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.tibco.com/assets/bltec3263ae44ae601b/2015-005-advisory.txt; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/assets/bltec3263ae44ae601b/2015-005-advisory.txt
CVE: CVE-2015-6368
Published: 2015-11-19
Description: Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to read files via a crafted HTTP request, aka Bug ID CSCux10608.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-firepower; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-firepower
CVE: CVE-2015-6369
Published: 2015-11-19
Description: The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire
CVE: CVE-2015-6370
Published: 2015-11-19
Description: The Management I/O (MIO) component in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire1; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire1
CVE: CVE-2015-6371
Published: 2015-11-19
Description: Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote authenticated users to read arbitrary files via crafted parameters to unspecified scripts, aka Bug ID CSCux10621.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower1; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower1
CVE: CVE-2015-6374
Published: 2015-11-19
Description: The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower4; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower4
CVE: CVE-2015-4112
Published: 2015-11-19
Description: The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://www.blackberry.com/btsc/KB37573; http://www.securitytracker.com/id/1034154; http://www.blackberry.com/btsc/KB37573
CVE: CVE-2015-7910
Published: 2015-11-19
Description: Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-284
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-321-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-321-01
CVE: CVE-2015-8236
Published: 2015-11-19
Description: Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: https://www.arista.com/support/advisories-notices/security-advisories/1221-security-advisory-15; https://www.arista.com/support/advisories-notices/security-advisories/1221-security-advisory-15
CVE: CVE-2014-9756
Published: 2015-11-19
Description: The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00077.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00145.html; http://www.openwall.com/lists/oss-security/2014/12/24/3
CVE: CVE-2015-0794
Published: 2015-11-19
Description: modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-bugs/2015-06/msg02580.html; http://lists.opensuse.org/opensuse-bugs/2015-06/msg02585.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00098.html
CVE: CVE-2015-7385
Published: 2015-11-19
Description: Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134415/Open-Xchange-Guard-2.0-Cross-Site-Scripting.html; http://software.open-xchange.com/products/guard/doc/Release_Notes_for_Patch_Release_2777_2.0.0_2015-09-30.pdf; http://www.securityfocus.com/archive/1/536923/100/0/threaded
CVE: CVE-2015-7845
Published: 2015-11-19
Description: The exception handling mechanism in the CLI Module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V100R001C20SPH605 allows remote attackers to cause a denial of service (CLI outage) via crafted SSH packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-453512.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-453512.htm
CVE: CVE-2015-7984
Published: 2015-11-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.horde.org/archives/announce/2015/001124.html; http://lists.horde.org/archives/announce/2015/001137.html; http://lists.horde.org/archives/announce/2015/001138.html
CVE: CVE-2015-8083
Published: 2015-11-19
Description: An unspecified module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V200R003C00SPC300 does not properly initialize memory when processing timeout messages, which allows remote attackers to cause a denial of service (out-of-bounds memory access and device restart) via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-453506.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-453506.htm
CVE: CVE-2015-8087
Published: 2015-11-19
Description: Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457933.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457933.htm
CVE: CVE-2015-7771
Published: 2015-11-20
Description: Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID that is encountered by an applican application, a different vulnerability than CVE-2015-7772.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN71088919/995707/index.html; http://jvn.jp/en/jp/JVN71088919/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000178
CVE: CVE-2015-7772
Published: 2015-11-20
Description: Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers WebView anchor attachment in an applican application, a different vulnerability than CVE-2015-7771.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN64625488/995707/index.html; http://jvn.jp/en/jp/JVN64625488/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000179
CVE: CVE-2015-7773
Published: 2015-11-20
Description: Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.
CVSS Score: 6.5 (MEDIUM)
References: http://getkirby.com/changelog/kirby-2-1-2; http://jvn.jp/en/jp/JVN34780384/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000182
CVE: CVE-2009-5149
Published: 2015-11-21
Description: Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://www.borfast.com/projects/arris-password-of-the-day-generator/; http://www.kb.cert.org/vuls/id/419568; https://github.com/borfast/arrispwgen
CVE: CVE-2015-6375
Published: 2015-11-21
Description: The debug-logging (aka debug cns) feature in Cisco Networking Services (CNS) for IOS 15.2(2)E3 allows local users to obtain sensitive information by reading an unspecified file, aka Bug ID CSCux18010.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151120-ns; http://www.securityfocus.com/bid/77676; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151120-ns
CVE: CVE-2015-6376
Published: 2015-11-21
Description: Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv72412.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151120-tvcs; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151120-tvcs