deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0540
Published: 2015-05-25
Description: SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/bugtraq/2015/May/98; http://seclists.org/bugtraq/2015/May/98
CVE: CVE-2015-0935
Published: 2015-05-25
Description: Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/978652; http://www.securityfocus.com/bid/74460; https://www.exploit-db.com/exploits/39958/
CVE: CVE-2015-2694
Published: 2015-05-25
Description: The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/74824
CVE: CVE-2015-2946
Published: 2015-05-25
Description: Stack-based buffer overflow in the Open CAD Format Council SXF common library before 3.30 allows remote attackers to execute arbitrary code via a crafted CAD file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN93976566/995630/index.html; http://jvn.jp/en/jp/JVN93976566/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000068
CVE: CVE-2014-8146
Published: 2015-05-25
Description: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.icu-project.org/trac/changeset/37162; http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
CVE: CVE-2014-8147
Published: 2015-05-25
Description: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.icu-project.org/trac/changeset/37080; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-0961
Published: 2015-05-25
Description: Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/534407; https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/; https://techlib.barracuda.com/BWF/UpdateSSLCerts
CVE: CVE-2015-0962
Published: 2015-05-25
Description: Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-18
References: http://www.kb.cert.org/vuls/id/534407; https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/; https://techlib.barracuda.com/BWF/UpdateSSLCerts
CVE: CVE-2015-1008
Published: 2015-05-26
Description: SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability; http://www.securityfocus.com/bid/74774; https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01
CVE: CVE-2015-1013
Published: 2015-05-26
Description: OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280; https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01
CVE: CVE-2015-4091
Published: 2015-05-26
Description: XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/133122/SAP-NetWeaver-AS-Java-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/May/96; http://www.securityfocus.com/archive/1/536239/100/0/threaded
CVE: CVE-2015-4092
Published: 2015-05-26
Description: Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2015/May/96; http://www.securityfocus.com/archive/1/536238/100/0/threaded; http://www.securityfocus.com/bid/74797
CVE: CVE-2015-0986
Published: 2015-05-26
Description: Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.moxa.com/support/download.aspx?d_id=2114; http://www.securityfocus.com/bid/73960; http://www.zerodayinitiative.com/advisories/ZDI-15-392
CVE: CVE-2015-3808
Published: 2015-05-26
Description: The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/74628; http://www.wireshark.org/security/wnpa-sec-2015-12.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11036
CVE: CVE-2015-3809
Published: 2015-05-26
Description: The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.debian.org/security/2015/dsa-3277; http://www.securityfocus.com/bid/74632; http://www.wireshark.org/security/wnpa-sec-2015-12.html
CVE: CVE-2015-3810
Published: 2015-05-26
Description: epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2015/dsa-3277; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/74629
CVE: CVE-2015-3811
Published: 2015-05-26
Description: epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://rhn.redhat.com/errata/RHSA-2017-0631.html; http://www.debian.org/security/2015/dsa-3277; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-3812
Published: 2015-05-26
Description: Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2017-0631.html; http://www.debian.org/security/2015/dsa-3277; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-3813
Published: 2015-05-26
Description: The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2017-0631.html; http://www.debian.org/security/2015/dsa-3277; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html
CVE: CVE-2015-3814
Published: 2015-05-26
Description: The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.debian.org/security/2015/dsa-3277; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74631
CVE: CVE-2015-3815
Published: 2015-05-26
Description: The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3277; http://www.securityfocus.com/bid/74630; http://www.wireshark.org/security/wnpa-sec-2015-18.html
CVE: CVE-2015-3902
Published: 2015-05-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html; http://www.debian.org/security/2015/dsa-3382; http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php
CVE: CVE-2015-3903
Published: 2015-05-26
Description: libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://cxsecurity.com/issue/WLB[PII_REDACTED]; http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html; http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html
CVE: CVE-2015-3906
Published: 2015-05-26
Description: The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/74837; http://www.wireshark.org/security/wnpa-sec-2015-18.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11188
CVE: CVE-2014-9710
Published: 2015-05-27
Description: The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
CVE: CVE-2014-9715
Published: 2015-05-27
Description: include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=223b02d923ecd7c84cf9780bb3686f455d279279; http://marc.info/?l=netfilter-devel&m=[PII_REDACTED]5200&w=2; http://rhn.redhat.com/errata/RHSA-2015-1534.html
CVE: CVE-2015-2666
Published: 2015-05-27
Description: Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153329.html; http://rhn.redhat.com/errata/RHSA-2015-1534.html
CVE: CVE-2015-2830
Published: 2015-05-27
Description: arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=956421fbb74c3a6261903f3836c0740187cf038b; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
CVE: CVE-2015-2922
Published: 2015-05-27
Description: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
CVSS Score: 3.3 (LOW)
CWE: CWE-17
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6fd99094de2b83d1d4c8457f2c83483b2828e75a; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
CVE: CVE-2015-3331
Published: 2015-05-27
Description: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ccfe8c3f7e52ae83155cb038753f4c75b774ca8a; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
CVE: CVE-2015-3332
Published: 2015-05-27
Description: A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://article.gmane.org/gmane.linux.network/359588; http://www.debian.org/security/2015/dsa-3237; http://www.openwall.com/lists/oss-security/2015/04/14/14
CVE: CVE-2015-3339
Published: 2015-05-27
Description: Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html
CVE: CVE-2015-3921
Published: 2015-05-27
Description: Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web script or HTML via the referer parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://forum.coppermine-gallery.net/index.php/topic%2C78194.0.html; http://packetstormsecurity.com/files/132004/Coppermine-Gallery-1.5.34-XSS-Open-Redirection.html; http://www.securityfocus.com/bid/74872
CVE: CVE-2015-3922
Published: 2015-05-27
Description: Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://forum.coppermine-gallery.net/index.php/topic%2C78194.0.html; http://packetstormsecurity.com/files/132004/Coppermine-Gallery-1.5.34-XSS-Open-Redirection.html; http://www.securityfocus.com/bid/74869
CVE: CVE-2015-4062
Published: 2015-05-27
Description: SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/74773; https://wordpress.org/plugins/newstatpress/changelog/
CVE: CVE-2015-4063
Published: 2015-05-27
Description: Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/74773; https://wordpress.org/plugins/newstatpress/changelog/
CVE: CVE-2015-4064
Published: 2015-05-27
Description: SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132037/WordPress-Landing-Pages-1.8.4-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/74777; https://wordpress.org/plugins/landing-pages/changelog/
CVE: CVE-2015-4065
Published: 2015-05-27
Description: Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132037/WordPress-Landing-Pages-1.8.4-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/74777; https://wordpress.org/plugins/landing-pages/changelog/
CVE: CVE-2015-4066
Published: 2015-05-27
Description: Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132036/WordPress-GigPress-2.3.8-SQL-Injection.html; http://www.securityfocus.com/bid/74747; https://wordpress.org/plugins/gigpress/changelog/
CVE: CVE-2015-1157
Published: 2015-05-28
Description: CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-17
References: http://9to5mac.com/2015/05/27/how-to-fix-ios-text-message-bug-crash-reboot/; http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
CVE: CVE-2014-6628
Published: 2015-05-28
Description: Aruba Networks ClearPass Policy Manager (CPPM) before 6.5.0 allows remote administrators to execute arbitrary code via unspecified vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt
CVE: CVE-2015-1389
Published: 2015-05-28
Description: Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132060/Aruba-ClearPass-Policy-Manager-6.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/May/115; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt