deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-6440
Published: 2016-10-27
Description: The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.0(1.10000.10), 11.5(1.10000.6), 11.5(0.99838.4). Known Fixed Releases: 11.0(1.22048.1), 11.5(0.98000.1070), 11.5(0.98000.284)11.5(0.98000.346), 11.5(0.98000.768), 11.5(1.10000.3), 11.5(1.10000.6), 11.5(2.10000.2).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93521; http://www.securitytracker.com/id/1037005; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-ucm
CVE: CVE-2016-6442
Published: 2016-10-27
Description: A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvb57213. Known Affected Releases: 11.0(1).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/93519; http://www.securitytracker.com/id/1037004; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-fin
CVE: CVE-2016-6443
Published: 2016-10-27
Description: A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/93522; http://www.securitytracker.com/id/1037006; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-prime
CVE: CVE-2016-6444
Published: 2016-10-27
Description: A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/93785; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-cms; http://www.securityfocus.com/bid/93785
CVE: CVE-2016-6445
Published: 2016-10-27
Description: A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc; http://www.securityfocus.com/bid/93517; http://www.securitytracker.com/id/1037000
CVE: CVE-2016-6446
Published: 2016-10-27
Description: A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93782; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-cms1; http://www.securityfocus.com/bid/93782
CVE: CVE-2016-1423
Published: 2016-10-28
Description: A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a user to click a malicious link in the MIQ view. The malicious link could be used to facilitate a cross-site scripting (XSS) or HTML injection attack. More Information: CSCuz02235. Known Affected Releases: 8.0.2-069. Known Fixed Releases: 9.1.1-038 9.7.2-047.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93912; http://www.securitytracker.com/id/1037113; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa4
CVE: CVE-2016-1480
Published: 2016-10-28
Description: A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, if the software is configured with message or content filters to scan incoming email attachments. More Information: CSCuw03606, CSCux59734. Known Affected Releases: 8.0.0-000 8.5.6-106 9.0.0-000 9.1.0-032 9.6.0-042 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.1.1-038 9.7.1-066.
CVSS Score: 7.5 (HIGH)
CWE: CWE-388
References: http://www.securityfocus.com/bid/93914; http://www.securitytracker.com/id/1037116; http://www.securitytracker.com/id/1037117
CVE: CVE-2016-1481
Published: 2016-10-28
Description: A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter that contains certain rules. More Information: CSCux59873. Known Affected Releases: 8.5.6-106 9.1.0-032 9.7.0-125. Known Fixed Releases: 9.1.1-038 9.7.1-066.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93908; http://www.securitytracker.com/id/1037123; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa1
CVE: CVE-2016-1486
Published: 2016-10-28
Description: A vulnerability in the email attachment scanning functionality of the Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition. Affected Products: This vulnerability affects Cisco AsyncOS Software releases 9.7.1 and later, prior to the first fixed release, for both virtual and hardware Cisco Email Security Appliances, if the AMP feature is configured to scan incoming email attachments. More Information: CSCuy99453. Known Affected Releases: 9.7.1-066. Known Fixed Releases: 10.0.0-125 9.7.1-207 9.7.2-047.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/93906; http://www.securitytracker.com/id/1037124; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa2
CVE: CVE-2016-6356
Published: 2016-10-28
Description: A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz63143. Known Affected Releases: 8.5.7-042 9.7.0-125. Known Fixed Releases: 10.0.0-125 9.1.1-038 9.7.2-047.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93907; http://www.securitytracker.com/id/1037122; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa3
CVE: CVE-2016-6357
Published: 2016-10-28
Description: A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. More Information: CSCuz01651. Known Affected Releases: 10.0.9-015 9.7.1-066 9.9.6-026.
CVSS Score: 7.5 (HIGH)
CWE: CWE-388
References: http://www.securityfocus.com/bid/93909; http://www.securitytracker.com/id/1037114; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa5
CVE: CVE-2016-6358
Published: 2016-10-28
Description: A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition when the FTP application unexpectedly quits. More Information: CSCux68539. Known Affected Releases: 9.1.0-032 9.7.1-000. Known Fixed Releases: 9.1.1-038.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93905; http://www.securitytracker.com/id/1037115; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa6
CVE: CVE-2016-6360
Published: 2016-10-28
Description: A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to the AMP process unexpectedly restarting. Affected Products: Cisco AsyncOS Software for Email Security Appliances (ESA) versions 9.5 and later up to the first fixed release, Cisco AsyncOS Software for Web Security Appliances (WSA) all versions prior to the first fixed release. More Information: CSCux56406, CSCux59928. Known Affected Releases: 9.6.0-051 9.7.0-125 8.8.0-085 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.7.1-066 WSA10.0.0-233.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93910; http://www.securitytracker.com/id/1037120; http://www.securitytracker.com/id/1037121
CVE: CVE-2016-6372
Published: 2016-10-28
Description: A vulnerability in the email message and content filtering for malformed Multipurpose Internet Mail Extensions (MIME) headers of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass the filtering functionality of the targeted device. Emails that should have been quarantined could instead be processed. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA on both virtual and hardware appliances that are configured with message or content filters to scan incoming email attachments. More Information: CSCuy54740, CSCuy75174. Known Affected Releases: 9.7.1-066 9.5.0-575 WSA10.0.0-000. Known Fixed Releases: 10.0.0-125 9.1.1-038 9.7.2-047.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93911; http://www.securitytracker.com/id/1037118; http://www.securitytracker.com/id/1037119
CVE: CVE-2016-6397
Published: 2016-10-28
Description: A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affected Products: This vulnerability affects Cisco IPICS releases 4.8(1) to 4.10(1). More Information: CSCva46644. Known Affected Releases: 4.10(1) 4.8(1) 4.8(2) 4.9(1) 4.9(2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/93913; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-ipics; http://www.securityfocus.com/bid/93913
CVE: CVE-2016-8332
Published: 2016-10-28
Description: A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3768; http://www.securityfocus.com/bid/93242; http://www.securitytracker.com/id/1038623
CVE: CVE-2016-8339
Published: 2016-10-28
Description: A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/93283; http://www.talosintelligence.com/reports/TALOS-2016-0206/; https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977
CVE: CVE-2016-7919
Published: 2016-10-28
Description: Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component.  NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-200, CWE-89
References: http://www.securityfocus.com/bid/93971; https://tracker.moodle.org/browse/MDL-56298; https://www.youtube.com/watch?v=pQS1GdQ3CBc
CVE: CVE-2016-8579
Published: 2016-10-28
Description: docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://www.securityfocus.com/bid/93560; https://github.com/appc/docker2aci/issues/203; http://www.securityfocus.com/bid/93560
CVE: CVE-2016-8580
Published: 2016-10-28
Description: PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/93864; https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities; https://www.exploit-db.com/exploits/40682/
CVE: CVE-2016-8581
Published: 2016-10-28
Description: A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93862; https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities; https://www.exploit-db.com/exploits/40683/
CVE: CVE-2016-8582
Published: 2016-10-28
Description: A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/93866; https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities; https://www.exploit-db.com/exploits/40684/
CVE: CVE-2016-8583
Published: 2016-10-28
Description: Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93863; https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities; http://www.securityfocus.com/bid/93863
CVE: CVE-2016-8596
Published: 2016-10-28
Description: Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94226; https://github.com/GomSpace/libcsp/pull/80; http://www.securityfocus.com/bid/94226
CVE: CVE-2016-8597
Published: 2016-10-28
Description: Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94226; https://github.com/GomSpace/libcsp/pull/80; http://www.securityfocus.com/bid/94226
CVE: CVE-2016-8598
Published: 2016-10-28
Description: Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94226; https://github.com/GomSpace/libcsp/pull/80; http://www.securityfocus.com/bid/94226
CVE: CVE-2016-8600
Published: 2016-10-28
Description: In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254, CWE-264
References: http://seclists.org/fulldisclosure/2016/Oct/63; http://www.securityfocus.com/bid/93798; https://github.com/dotCMS/core/issues/9330
CVE: CVE-2016-8867
Published: 2016-10-28
Description: Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94228; http://www.securitytracker.com/id/1037203; https://www.docker.com/docker-cve-database
CVE: CVE-2016-8871
Published: 2016-10-28
Description: In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94225; https://botan.randombit.net/security.html; http://www.securityfocus.com/bid/94225
CVE: CVE-2016-8889
Published: 2016-10-28
Description: In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including private keys and the wallet passphrase in its persistent command history.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://www.securityfocus.com/bid/94235; https://bitcointalk.org/index.php?topic=1618462.0; https://github.com/bitcoinknots/bitcoin/blob/v0.13.1.knots20161027/doc/release-notes.md
CVE: CVE-2016-9017
Published: 2016-10-28
Description: Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "opname in crafted JavaScript file" approach, related to an "Out-of-Bounds read" issue affecting the jsC_dumpfunction function in the jsdump.c component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-200
References: http://bugs.ghostscript.com/show_bug.cgi?id=697171; http://www.securityfocus.com/bid/94241; http://bugs.ghostscript.com/show_bug.cgi?id=697171
CVE: CVE-2016-9018
Published: 2016-10-28
Description: Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5.705 through a crafted .QCP media file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/94239; https://www.exploit-db.com/exploits/40617/; http://www.securityfocus.com/bid/94239
CVE: CVE-2016-9028
Published: 2016-10-28
Description: Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/93947; http://www.securitytracker.com/id/1037175; https://support.citrix.com/article/CTX218361
CVE: CVE-2016-8331
Published: 2016-10-28
Description: An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/93898; http://www.talosintelligence.com/reports/TALOS-2016-0190/; https://security.gentoo.org/glsa/201701-16
CVE: CVE-2016-8333
Published: 2016-10-28
Description: An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus version 6.6.04 A specially crafted pdf file can cause a buffer overflow resulting in arbitrary code execution. An attacker can provide a malicious pdf file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93938; http://www.talosintelligence.com/reports/2016-TALOS-0200/; http://www.securityfocus.com/bid/93938
CVE: CVE-2016-8335
Published: 2016-10-28
Description: An exploitable stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus Version 6.6.04 (Sep 7 2012) NK - Linux x64 and Version 6.6.04 (Nov 14 2014) NK - Windows x64. A specially crafted pdf file can cause a buffer overflow resulting in arbitrary code execution. An attacker can send/provide malicious pdf file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93936; http://www.talosintelligence.com/reports/2016-TALOS-0202/; http://www.securityfocus.com/bid/93936
CVE: CVE-2016-4393
Published: 2016-10-28
Description: HPE System Management Homepage before v7.6 allows "remote authenticated" attackers to obtain sensitive information via unspecified vectors, related to an "XSS" issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93961; https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05320149; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
CVE: CVE-2016-4394
Published: 2016-10-28
Description: HPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive information via unspecified vectors, related to an "HSTS" issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/93961; https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05320149; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722