deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-7947
Published: 2015-01-22
Description: OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html; http://rhn.redhat.com/errata/RHSA-2015-0093.html
CVE: CVE-2014-7948
Published: 2015-01-22
Description: The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5 application content via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html; http://rhn.redhat.com/errata/RHSA-2015-0093.html
CVE: CVE-2015-1205
Published: 2015-01-22
Description: Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
CVE: CVE-2015-1346
Published: 2015-01-22
Description: Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://rhn.redhat.com/errata/RHSA-2015-0093.html; http://secunia.com/advisories/62383
CVE: CVE-2014-8802
Published: 2015-01-23
Description: The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/62351; http://security.szurek.pl/pie-register-2013-privilege-escalation.html; https://wordpress.org/plugins/pie-register/changelog/
CVE: CVE-2014-9623
Published: 2015-01-23
Description: OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2015-0644.html; http://rhn.redhat.com/errata/RHSA-2015-0837.html; http://rhn.redhat.com/errata/RHSA-2015-0838.html
CVE: CVE-2014-9638
Published: 2015-01-23
Description: oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
CVE: CVE-2014-9639
Published: 2015-01-23
Description: Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
CVE: CVE-2014-9640
Published: 2015-01-23
Description: oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0051.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148852.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00032.html
CVE: CVE-2015-1176
Published: 2015-01-23
Description: Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130057/osTicket-1.9.4-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534526/100/0/threaded; http://www.securityfocus.com/bid/72276
CVE: CVE-2015-1180
Published: 2015-01-23
Description: Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130063/EventSentry-3.1.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534531/100/0/threaded; http://packetstormsecurity.com/files/130063/EventSentry-3.1.0-Cross-Site-Scripting.html
CVE: CVE-2015-1200
Published: 2015-01-23
Description: Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
CVSS Score: 2.1 (LOW)
CWE: CWE-362
References: http://seclists.org/oss-sec/2015/q1/177; http://www.securityfocus.com/bid/72101; https://exchange.xforce.ibmcloud.com/vulnerabilities/100207
CVE: CVE-2015-1347
Published: 2015-01-23
Description: Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket-1.8/commit/b38b3ca[PII_REDACTED]cc9ff74b3c24a4a78c9c2d1; https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.5.1; https://github.com/osTicket/osTicket-1.8/commit/b38b3ca[PII_REDACTED]cc9ff74b3c24a4a78c9c2d1
CVE: CVE-2015-0310
Published: 2015-01-23
Description: Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://helpx.adobe.com/security/products/flash-player/apsb15-02.html; http://secunia.com/advisories/62452; http://secunia.com/advisories/62601
CVE: CVE-2015-0311
Published: 2015-01-23
Description: Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
CVSS Score: 9.8 (CRITICAL)
References: http://helpx.adobe.com/security/products/flash-player/apsa15-01.html; http://helpx.adobe.com/security/products/flash-player/apsb15-03.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html
CVE: CVE-2014-8148
Published: 2015-01-26
Description: The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-01/msg00051.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html; http://www.openwall.com/lists/oss-security/2015/01/05/2
CVE: CVE-2014-8157
Published: 2015-01-26
Description: Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0038.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00014.html; http://rhn.redhat.com/errata/RHSA-2015-0074.html
CVE: CVE-2014-8158
Published: 2015-01-26
Description: Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0038.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00014.html; http://rhn.redhat.com/errata/RHSA-2015-0074.html
CVE: CVE-2014-9571
Published: 2015-01-26
Description: Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2015/q1/156; http://www.securitytracker.com/id/1031633; https://exchange.xforce.ibmcloud.com/vulnerabilities/100209
CVE: CVE-2014-9572
Published: 2015-01-26
Description: MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://seclists.org/oss-sec/2015/q1/158; http://www.securitytracker.com/id/1031633; https://exchange.xforce.ibmcloud.com/vulnerabilities/100211
CVE: CVE-2014-9573
Published: 2015-01-26
Description: SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/oss-sec/2015/q1/157; http://www.securitytracker.com/id/1031633; https://exchange.xforce.ibmcloud.com/vulnerabilities/100210
CVE: CVE-2015-1178
Published: 2015-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130061/X-CART-e-Commerce-5.1.8-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534529/100/0/threaded; http://www.securityfocus.com/bid/72275
CVE: CVE-2015-1179
Published: 2015-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130062/Mango-Automation-SCADA-HMI-2.4.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534530/100/0/threaded; http://packetstormsecurity.com/files/130062/Mango-Automation-SCADA-HMI-2.4.0-Cross-Site-Scripting.html
CVE: CVE-2015-1307
Published: 2015-01-26
Description: plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/01/22/6; http://www.securityfocus.com/bid/72285; https://www.kde.org/info/security/advisory-20150122-1.txt
CVE: CVE-2015-1308
Published: 2015-01-26
Description: kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/62051; http://www.openwall.com/lists/oss-security/2015/01/22/6; http://www.securityfocus.com/bid/72284
CVE: CVE-2014-9197
Published: 2015-01-27
Description: The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-306, CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02
CVE: CVE-2014-9198
Published: 2015-01-27
Description: The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.
CVSS Score: 10.0 (HIGH)
CWE: CWE-798, CWE-255
References: https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02; http://www.securityfocus.com/bid/72258; http://www.securityfocus.com/bid/77765
CVE: CVE-2014-9646
Published: 2015-01-27
Description: Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% directory, as demonstrated by program.exe, a different vulnerability than CVE-2015-1205.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; https://code.google.com/p/chromium/issues/detail?id=434964
CVE: CVE-2014-9647
Published: 2015-01-27
Description: Use-after-free vulnerability in PDFium, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/src/fpdfview.cpp and fpdfsdk/src/fsdk_mgr.cpp, a different vulnerability than CVE-2015-1205.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; https://code.google.com/p/chromium/issues/detail?id=410326
CVE: CVE-2014-9648
Published: 2015-01-27
Description: components/navigation_interception/intercept_navigation_resource_throttle.cc in Google Chrome before 40.0.2214.91 on Android does not properly restrict use of intent: URLs to open an application after navigation to a web site, which allows remote attackers to cause a denial of service (loss of browser access to that site) via crafted JavaScript code, as demonstrated by pandora.com and the Pandora application, a different vulnerability than CVE-2015-1205.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; https://code.google.com/p/chromium/issues/detail?id=331571
CVE: CVE-2014-9649
Published: 2015-01-27
Description: Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-0308.html; http://www.openwall.com/lists/oss-security/2015/01/21/13; http://www.rabbitmq.com/release-notes/README-3.4.1.txt
CVE: CVE-2014-9650
Published: 2015-01-27
Description: CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-0308.html; http://www.openwall.com/lists/oss-security/2015/01/21/13; http://www.rabbitmq.com/release-notes/README-3.4.1.txt
CVE: CVE-2015-0231
Published: 2015-01-27
Description: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
CVE: CVE-2015-0232
Published: 2015-01-27
Description: The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=21bc7464f454fec18a9ec024c738f195602fee2a; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2fc178cf448d8e1b95d1314e47eeef610729e0df
CVE: CVE-2015-1359
Published: 2015-01-27
Description: Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; https://code.google.com/p/chromium/issues/detail?id=421196
CVE: CVE-2015-1360
Published: 2015-01-27
Description: Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; https://code.google.com/p/chromium/issues/detail?id=416289
CVE: CVE-2015-1361
Published: 2015-01-27
Description: platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/01/stable-update.html; http://security.gentoo.org/glsa/glsa-201502-13.xml; http://src.chromium.org/viewvc/blink?view=revision&revision=183296
CVE: CVE-2015-1362
Published: 2015-01-27
Description: Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/130037/Exif-Pilot-4.7.2-Buffer-Overflow.html; http://www.exploit-db.com/exploits/35870; http://packetstormsecurity.com/files/130037/Exif-Pilot-4.7.2-Buffer-Overflow.html
CVE: CVE-2015-1363
Published: 2015-01-27
Description: Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130066/articleFR-CMS-3.0.5-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/101; http://www.itas.vn/news/itas-team-found-out-XSS-vulnerability-in-articlefr-cms-73.html
CVE: CVE-2015-1364
Published: 2015-01-27
Description: SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2015/Jan/81; http://www.exploit-db.com/exploits/35857; http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-articlefr-cms-72.html
CVE: CVE-2015-1365
Published: 2015-01-27
Description: Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/117147; http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html; http://seclists.org/fulldisclosure/2015/Jan/75
CVE: CVE-2015-1366
Published: 2015-01-27
Description: Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/117144; http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html; http://seclists.org/fulldisclosure/2015/Jan/75
CVE: CVE-2015-1367
Published: 2015-01-27
Description: SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129990/CatBot-0.4.2-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/63; http://www.securityfocus.com/archive/1/534490/100/0/threaded
CVE: CVE-2015-1368
Published: 2015-01-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/116961; http://osvdb.org/show/osvdb/116962; http://osvdb.org/show/osvdb/116963
CVE: CVE-2015-1369
Published: 2015-01-27
Description: SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2015/01/23/2; https://github.com/sequelize/sequelize/pull/2919; https://nodesecurity.io/advisories/sequelize-sql-injection-order
CVE: CVE-2015-1370
Published: 2015-01-27
Description: Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/01/23/2; https://github.com/chjj/marked/issues/492; https://github.com/evilpacket/marked/commit/3c[PII_REDACTED]7c45a7fa11ab6cb88be6694a1ba