deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1409
Published: 2016-05-29
Description: The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages, aka Bug ID CSCuz66542, as exploited in the wild in May 2016.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160824-01-ipv6-en; http://www.securityfocus.com/bid/90872
CVE: CVE-2016-0907
Published: 2016-05-30
Description: EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a similar issue to CVE-2016-2115.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://seclists.org/bugtraq/2016/May/117; http://seclists.org/bugtraq/2016/May/117
CVE: CVE-2016-1999
Published: 2016-05-30
Description: The server in HP Release Control 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/90778; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05063986; http://www.securityfocus.com/bid/90778
CVE: CVE-2016-2023
Published: 2016-05-30
Description: HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141083; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141083
CVE: CVE-2016-2025
Published: 2016-05-30
Description: HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related to the Web Client, Service Request Catalog, and Mobility components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035954; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149290; http://www.securitytracker.com/id/1035954
CVE: CVE-2016-2309
Published: 2016-05-30
Description: iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-345
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-138-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-138-01
CVE: CVE-2016-2311
Published: 2016-05-30
Description: Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover administrator and user passwords via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-147-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-147-03
CVE: CVE-2016-4118
Published: 2016-05-30
Description: Untrusted search path vulnerability in the installer in Adobe Connect Add-In before 11.9.976.291 on Windows allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/90815; http://www.securitytracker.com/id/1035958; https://helpx.adobe.com/security/products/connect/apsb16-17.html
CVE: CVE-2016-0875
Published: 2016-05-31
Description: Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01
CVE: CVE-2016-0876
Published: 2016-05-31
Description: Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01
CVE: CVE-2016-0877
Published: 2016-05-31
Description: Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01
CVE: CVE-2016-0878
Published: 2016-05-31
Description: Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.
CVSS Score: 7.5 (HIGH)
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01
CVE: CVE-2016-0879
Published: 2016-05-31
Description: Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01
CVE: CVE-2016-2285
Published: 2016-05-31
Description: Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2016/May/7; https://ics-cert.us-cert.gov/advisories/ICSA-16-145-01; http://seclists.org/fulldisclosure/2016/May/7
CVE: CVE-2016-2286
Published: 2016-05-31
Description: Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 have a blank default password, which allows remote attackers to obtain access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2016/May/7; https://ics-cert.us-cert.gov/advisories/ICSA-16-145-01; http://seclists.org/fulldisclosure/2016/May/7
CVE: CVE-2016-2295
Published: 2016-05-31
Description: Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allow remote attackers to obtain sensitive cleartext information by reading a configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/May/7; https://ics-cert.us-cert.gov/advisories/ICSA-16-145-01; http://seclists.org/fulldisclosure/2016/May/7
CVE: CVE-2016-4501
Published: 2016-05-31
Description: Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-147-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-147-01
CVE: CVE-2016-4502
Published: 2016-05-31
Description: Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-147-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-147-01
CVE: CVE-2016-4505
Published: 2016-05-31
Description: Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-140-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-140-01
CVE: CVE-2016-4506
Published: 2016-05-31
Description: Cross-site request forgery (CSRF) vulnerability on Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-140-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-140-01
CVE: CVE-2016-4521
Published: 2016-05-31
Description: Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-147-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-147-02
CVE: CVE-2016-4784
Published: 2016-05-31
Description: A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 : All versions < V 4.83; SIPROTEC 7UT686 : All versions < V 4.01; SIPROTEC 7SD686 : All versions < V 4.03; SIPROTEC 7SJ66 : All versions < V 4.20. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain sensitive device information if network access was obtained.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/90773; http://www.securityfocus.com/bid/99471; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-547990.pdf
CVE: CVE-2016-4785
Published: 2016-05-31
Description: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/90773; http://www.securityfocus.com/bid/99471; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-547990.pdf
CVE: CVE-2014-2656
Published: 2016-06-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that the vulnerability report was not valid.  Notes: none
CVE: CVE-2016-0288
Published: 2016-06-01
Description: IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 6.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980055; http://www.securitytracker.com/id/1035927; http://www-01.ibm.com/support/docview.wss?uid=swg21980055
CVE: CVE-2016-4500
Published: 2016-06-01
Description: Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-152-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-152-01
CVE: CVE-2016-1234
Published: 2016-06-01
Description: Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html
CVE: CVE-2016-2175
Published: 2016-06-01
Description: Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
CVSS Score: 7.8 (HIGH)
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8%40apache.org%3E; http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html; http://rhn.redhat.com/errata/RHSA-2017-0179.html
CVE: CVE-2016-3075
Published: 2016-06-01
Description: Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html
CVE: CVE-2016-3088
Published: 2016-06-01
Description: The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt; http://rhn.redhat.com/errata/RHSA-2016-2036.html; http://www.securitytracker.com/id/1035951
CVE: CVE-2016-3094
Published: 2016-06-01
Description: PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-287
References: http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E; http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html; http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html
CVE: CVE-2016-3697
Published: 2016-06-01
Description: libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html; http://rhn.redhat.com/errata/RHSA-2016-1034.html; http://rhn.redhat.com/errata/RHSA-2016-2634.html
CVE: CVE-2016-4432
Published: 2016-06-01
Description: The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E; http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html; http://www.securityfocus.com/archive/1/538508/100/0/threaded
CVE: CVE-2015-8875
Published: 2016-06-01
Description: Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.debian.org/security/2016/dsa-3589; http://www.openwall.com/lists/oss-security/2016/05/12/3; http://www.openwall.com/lists/oss-security/2016/05/16/1
CVE: CVE-2016-1902
Published: 2016-06-01
Description: The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails; http://www.debian.org/security/2016/dsa-3588; https://github.com/symfony/symfony/pull/17359
CVE: CVE-2016-4423
Published: 2016-06-01
Description: The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3588; https://github.com/symfony/symfony/pull/18733; https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
CVE: CVE-2016-4453
Published: 2016-06-01
Description: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2016/05/30/2; http://www.securityfocus.com/bid/90928; http://www.ubuntu.com/usn/USN-3047-1
CVE: CVE-2016-4454
Published: 2016-06-01
Description: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/05/30/3; http://www.securityfocus.com/bid/90927; http://www.ubuntu.com/usn/USN-3047-1
CVE: CVE-2016-4810
Published: 2016-06-01
Description: Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Policy rules on the XenDesktop Delivery Controller via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://support.citrix.com/article/CTX213045; http://www.securitytracker.com/id/1036021; http://support.citrix.com/article/CTX213045
CVE: CVE-2016-4945
Published: 2016-06-01
Description: Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137221/Citrix-Netscaler-11.0-Build-64.35-Cross-Site-Scripting.html; http://persicon.com/tl_files/advisories/PERSICON-advisory-2016-No-1-citrix.txt; http://support.citrix.com/article/CTX213313
CVE: CVE-2016-5126
Published: 2016-06-01
Description: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a6b3167fa0e825aebb5a7cd8b437b6d41584a196; http://rhn.redhat.com/errata/RHSA-2016-1606.html; http://rhn.redhat.com/errata/RHSA-2016-1607.html
CVE: CVE-2016-1370
Published: 2016-06-03
Description: Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime3; http://www.securitytracker.com/id/1036016; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime3
CVE: CVE-2016-1388
Published: 2016-06-03
Description: Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime; http://www.securitytracker.com/id/1036013; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime
CVE: CVE-2015-8872
Published: 2016-06-03
Description: The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two error."
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00001.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00014.html; http://www.securityfocus.com/bid/90311
CVE: CVE-2016-0363
Published: 2016-06-03
Description: The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html