deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1306
Published: 2016-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Fog Director 1.0(0) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux80466.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-fd; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-fd
CVE: CVE-2016-1310
Published: 2016-02-06
Description: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 11.5(0.199) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy09033.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-uc; http://www.securitytracker.com/id/1034937; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-uc
CVE: CVE-2016-1311
Published: 2016-02-06
Description: Cross-site scripting (XSS) vulnerability in the management interface in Cisco Jabber Guest Server 10.6(8) allows remote attackers to inject arbitrary web script or HTML via the host tag parameter, aka Bug ID CSCuy08224.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-jgs; http://www.securitytracker.com/id/1034936; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-jgs
CVE: CVE-2016-0801
Published: 2016-02-07
Description: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
CVE: CVE-2016-0802
Published: 2016-02-07
Description: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25306181.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
CVE: CVE-2016-0803
Published: 2016-02-07
Description: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fav/+/50270d98e26fa18b20ca88216c3526667b724ba7; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0804
Published: 2016-02-07
Description: The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fav/+/224858e719d045c8554856b12c4ab73d2375cf33; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0805
Published: 2016-02-07
Description: The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25773204.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0806
Published: 2016-02-07
Description: The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25344453.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0807
Published: 2016-02-07
Description: The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fsystem%2Fcore/+/d917514bd6b270df431ea4e781a865764d406120; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0808
Published: 2016-02-07
Description: Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-19
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform/frameworks/minikin/+/ed4c8d79153baab7f26562afb8930652dfbf853b; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0809
Published: 2016-02-07
Description: Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform/hardware/broadcom/wlan/+/2c5a4fac8bc8198f6a2635ede776f8de40a0c3e1; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0810
Published: 2016-02-07
Description: media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25781119.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fav/+/19c47afbc402542720ddd280e1bbde3b2277b586; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0811
Published: 2016-02-07
Description: Integer overflow in the BnCrypto::onTransact function in media/libmedia/ICrypto.cpp in libmediaplayerservice in Android 6.x before 2016-02-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an improper size calculation, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25800375.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fav/+/22f824feac43d5758f9a70b77f2aca840ba62c3b; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0812
Published: 2016-02-07
Description: The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.0 before 2016-02-01 does not properly check for setup completion, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25229538.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/84669ca8de55d38073a0dcb01074233b0a417541; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2016-0813
Published: 2016-02-07
Description: packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-01 does not properly check for device provisioning, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25476219.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-02-01.html; https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/16a76dadcc23a13223e9c2216dad1fe5cad7d6e1; http://source.android.com/security/bulletin/2016-02-01.html
CVE: CVE-2015-6398
Published: 2016-02-07
Description: Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (device reload) via an IPv4 ICMP packet with the IP Record Route option, aka Bug ID CSCuq57512.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-n9knci; http://www.securitytracker.com/id/1034928; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-n9knci
CVE: CVE-2016-1301
Published: 2016-02-07
Description: The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112) allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-prsm; http://www.securitytracker.com/id/1034926; http://www.securitytracker.com/id/1034927
CVE: CVE-2016-1302
Published: 2016-02-07
Description: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-apic; http://www.securitytracker.com/id/1034925; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-apic
CVE: CVE-2016-1305
Published: 2016-02-07
Description: Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities, aka Bug ID CSCux15511.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-apic-em; http://www.securitytracker.com/id/1034902; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-apic-em
CVE: CVE-2016-1307
Published: 2016-02-07
Description: The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-255, CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160202-fducce; http://www.securitytracker.com/id/1034920; http://www.securitytracker.com/id/1034921
CVE: CVE-2016-1308
Published: 2016-02-07
Description: SQL injection vulnerability in Cisco Unified Communications Manager 10.5(2.13900.9) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCux99227.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-ucm; http://www.securitytracker.com/id/1034938; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-ucm
CVE: CVE-2016-1309
Published: 2016-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meetings Server 2.5.1.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy01843.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160202-wms; http://www.securitytracker.com/id/1034919; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160202-wms
CVE: CVE-2013-4312
Published: 2016-02-08
Description: The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=712f4aad406bb1ed67f3f98d04c044191f0ff593; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
CVE: CVE-2015-7513
Published: 2016-02-08
Description: arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0185604c2d82c560dab2f2933a18f797e74ab5a8; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175792.html
CVE: CVE-2015-7550
Published: 2016-02-08
Description: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b4a1b4f5047e4f54e194681125c74c0aa64d637d; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html
CVE: CVE-2015-7566
Published: 2016-02-08
Description: The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175792.html
CVE: CVE-2015-8539
Published: 2016-02-08
Description: The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096fe9eaea40a17e125569f9e657e34cdb6d73bd; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00008.html
CVE: CVE-2015-8575
Published: 2016-02-08
Description: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5233252fce714053f[PII_REDACTED]571a2da9cbfb4; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
CVE: CVE-2015-8709
Published: 2016-02-08
Description: kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call.  NOTE: the vendor states "there is no kernel bug here.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html
CVE: CVE-2015-8767
Published: 2016-02-08
Description: net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=635682a14427d241bab7bbdeebb48a7d7b91638e; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
CVE: CVE-2015-8785
Published: 2016-02-08
Description: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ca8138f014a913f98e6ef40e939868e1e9ea876; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html
CVE: CVE-2015-8787
Published: 2016-02-08
Description: The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
CVE: CVE-2016-0723
Published: 2016-02-08
Description: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c17c861a357e9458001f021a7afa7aab9937439; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
CVE: CVE-2016-0728
Published: 2016-02-08
Description: The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176194.html
CVE: CVE-2015-2012
Published: 2016-02-08
Description: The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT09866; http://www-01.ibm.com/support/docview.wss?uid=swg21968399; http://www.securitytracker.com/id/1034943
CVE: CVE-2016-0603
Published: 2016-02-08
Description: Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.  NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."
CVSS Score: 7.6 (HIGH)
References: http://seclists.org/fulldisclosure/2016/Feb/54; http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0[PII_REDACTED].html; http://www.securityfocus.com/archive/1/537462/100/0/threaded
CVE: CVE-2016-2200
Published: 2016-02-08
Description: Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/83106; http://www.securitytracker.com/id/1034954; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-253230.pdf
CVE: CVE-2016-2201
Published: 2016-02-08
Description: Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to bypass a replay protection mechanism via packets on TCP port 102.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/83110; http://www.securitytracker.com/id/1034954; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-253230.pdf
CVE: CVE-2016-2230
Published: 2016-02-08
Description: OpenELEC and RasPlex devices have a hardcoded password for the root account, which makes it easier for remote attackers to obtain access via an SSH session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/544527; https://github.com/RasPlex/RasPlex/issues/453; http://www.kb.cert.org/vuls/id/544527