deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5188
Published: 2015-10-27
Description: Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2015-1904.html; http://rhn.redhat.com/errata/RHSA-2015-1905.html; http://rhn.redhat.com/errata/RHSA-2015-1906.html
CVE: CVE-2015-5220
Published: 2015-10-27
Description: The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2015-1904.html; http://rhn.redhat.com/errata/RHSA-2015-1905.html; http://rhn.redhat.com/errata/RHSA-2015-1906.html
CVE: CVE-2015-5240
Published: 2015-10-27
Description: Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.
CVSS Score: 3.5 (LOW)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2015-1909.html; http://www.openwall.com/lists/oss-security/2015/09/08/9; https://bugs.launchpad.net/neutron/+bug/1489111
CVE: CVE-2015-5262
Published: 2015-10-27
Description: http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html
CVE: CVE-2015-7986
Published: 2015-10-27
Description: The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/135416/SAP-HANA-hdbindexserver-Memory-Corruption.html; http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-october-2015--review; http://seclists.org/fulldisclosure/2016/Jan/94
CVE: CVE-2015-3967
Published: 2015-10-28
Description: Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3968
Published: 2015-10-28
Description: The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP port 21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3969
Published: 2015-10-28
Description: Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3970
Published: 2015-10-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3971
Published: 2015-10-28
Description: The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrary JASIC code, via a session on TCP port 1239.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3972
Published: 2015-10-28
Description: The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 10.0 (HIGH)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-3973
Published: 2015-10-28
Description: Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations on session-token values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
CVE: CVE-2015-5712
Published: 2015-10-28
Description: Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote authenticated users to obtain sensitive system information by visiting an unspecified URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1034011; http://www.tibco.com/assets/blt3a3a55ab42f2f5cd/2015-004-advisory.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2015-5713
Published: 2015-10-28
Description: Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote attackers to obtain sensitive log information by visiting an unspecified URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1034011; http://www.tibco.com/assets/blt3a3a55ab42f2f5cd/2015-004-advisory.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2015-6486
Published: 2015-10-28
Description: SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03
CVE: CVE-2015-6488
Published: 2015-10-28
Description: Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03
CVE: CVE-2015-6490
Published: 2015-10-28
Description: Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03
CVE: CVE-2015-6491
Published: 2015-10-28
Description: Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03
CVE: CVE-2015-6492
Published: 2015-10-28
Description: Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted HTTP request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03
CVE: CVE-2015-6493
Published: 2015-10-28
Description: Cross-site request forgery (CSRF) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-6494
Published: 2015-10-28
Description: Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-7836
Published: 2015-10-28
Description: Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033973; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-921524.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-01
CVE: CVE-2015-7873
Published: 2015-10-28
Description: The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html
CVE: CVE-2015-7900
Published: 2015-10-28
Description: Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-7901
Published: 2015-10-28
Description: Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://www.exploit-db.com/exploits/42698/; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-7902
Published: 2015-10-28
Description: Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-7903
Published: 2015-10-28
Description: SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2015-7904
Published: 2015-10-28
Description: Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
CVSS Score: 6.5 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
CVE: CVE-2014-8912
Published: 2015-10-28
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF18, and 8.5.0 before CF08 improperly restricts resource access, which allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by configuration information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI47714; http://www-01.ibm.com/support/docview.wss?uid=swg21963226; http://www.securitytracker.com/id/1033988
CVE: CVE-2015-6034
Published: 2015-10-28
Description: EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/672500; https://www.epson.com/cgi-bin/Store/support/supAdvice.jsp?type=highlights&noteoid=288045; http://www.kb.cert.org/vuls/id/672500
CVE: CVE-2015-7649
Published: 2015-10-28
Description: Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033990; https://helpx.adobe.com/security/products/shockwave/apsb15-26.html; http://www.securitytracker.com/id/1033990
CVE: CVE-2015-2898
Published: 2015-10-29
Description: Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the SetGroupSequenceEx na_setgroupsequenceex function, (2) the FormatDate julptostr function, and (3) the UserFindingCodes addtocl function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/675052; http://www.securifera.com/advisories/CVE-2015-2898-2901/; http://www.kb.cert.org/vuls/id/675052
CVE: CVE-2015-2899
Published: 2015-10-29
Description: Heap-based buffer overflow in the QualifierList retrieve_qualifier_list function in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a long list name in a packet on port 8190.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/675052; http://www.securifera.com/advisories/CVE-2015-2898-2901/; http://www.kb.cert.org/vuls/id/675052
CVE: CVE-2015-2900
Published: 2015-10-29
Description: The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted packet on port 8190.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/675052; http://www.securifera.com/advisories/CVE-2015-2898-2901/; http://www.kb.cert.org/vuls/id/675052
CVE: CVE-2015-2901
Published: 2015-10-29
Description: Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/675052; http://www.securifera.com/advisories/CVE-2015-2898-2901/; http://www.kb.cert.org/vuls/id/675052
CVE: CVE-2015-4994
Published: 2015-10-29
Description: Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image, aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ, a different vulnerability than CVE-2015-5040.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969050; http://www.securitytracker.com/id/1033974; http://www-01.ibm.com/support/docview.wss?uid=swg21969050
CVE: CVE-2015-4997
Published: 2015-10-29
Description: IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI47694; http://www-01.ibm.com/support/docview.wss?uid=swg21968474; http://www.securitytracker.com/id/1033982
CVE: CVE-2015-5040
Published: 2015-10-29
Description: Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image, aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ, a different vulnerability than CVE-2015-4994.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969050; http://www.securitytracker.com/id/1033974; http://www-01.ibm.com/support/docview.wss?uid=swg21969050
CVE: CVE-2015-5668
Published: 2015-10-29
Description: SQL injection vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN58615092/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000167; http://www.tpj.co.jp/enisys/resource.html
CVE: CVE-2015-5669
Published: 2015-10-29
Description: Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://jvn.jp/en/jp/JVN33179297/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000168; http://www.tpj.co.jp/enisys/resource.html
CVE: CVE-2015-5670
Published: 2015-10-29
Description: Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN13874649/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000169; http://www.tpj.co.jp/enisys/resource.html
CVE: CVE-2015-5671
Published: 2015-10-29
Description: Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN68289108/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000170; http://www.tpj.co.jp/enisys/resource.html
CVE: CVE-2015-6006
Published: 2015-10-29
Description: The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbitrary code or cause a denial of service (integer truncation and heap-based buffer overflow) via a crafted packet on port 8190.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/675052; http://www.securifera.com/advisories/CVE-2015-2898-2901/; http://www.kb.cert.org/vuls/id/675052
CVE: CVE-2015-5292
Published: 2015-10-29
Description: Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169110.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169597.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169613.html
CVE: CVE-2015-3230
Published: 2015-10-29
Description: 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html; https://bugzilla.redhat.com/show_bug.cgi?id=1230996
CVE: CVE-2015-5285
Published: 2015-10-29
Description: CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
CVSS Score: 5.0 (MEDIUM)
References: http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php; https://kallithea-scm.org/security/cve-2015-5285.html
CVE: CVE-2015-5955
Published: 2015-10-29
Description: ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-522
References: https://owncloud.org/security/advisory/?id=oc-sa-2015-013; https://owncloud.org/security/advisory/?id=oc-sa-2015-013
CVE: CVE-2015-7297
Published: 2015-10-29
Description: SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sql-injection.html; http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html; http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html
CVE: CVE-2015-7713
Published: 2015-10-29
Description: OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://rhn.redhat.com/errata/RHSA-2015-2684.html; http://www.securityfocus.com/bid/76960; https://access.redhat.com/errata/RHSA-2015:2673
CVE: CVE-2015-7857
Published: 2015-10-29
Description: SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sql-injection.html; http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html; http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html