deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3648
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-254
References: http://www.securityfocus.com/bid/91441; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-3649
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91440; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-3650
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-254
References: http://www.securityfocus.com/bid/91432; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-3651
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91445; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-3652
Published: 2016-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91444; http://www.securitytracker.com/id/1036196; https://www.exploit-db.com/exploits/40041/
CVE: CVE-2016-3653
Published: 2016-06-30
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/91442; http://www.securitytracker.com/id/1036196; https://www.exploit-db.com/exploits/40041/
CVE: CVE-2016-5304
Published: 2016-06-30
Description: Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/91447; http://www.securitytracker.com/id/1036196; https://www.exploit-db.com/exploits/40041/
CVE: CVE-2016-5305
Published: 2016-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via a "DOM link manipulation" attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91448; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-5306
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for unintended HTTP traffic on port 8445.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-254
References: http://www.securityfocus.com/bid/91449; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-5307
Published: 2016-06-30
Description: Directory traversal vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to read arbitrary files in the web-root directory tree via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/91443; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-0362
Published: 2016-07-01
Description: IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet or Internet hosts, via a crafted proxy request to a web service.
CVSS Score: 7.7 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980749; http://www-01.ibm.com/support/docview.wss?uid=swg21980749
CVE: CVE-2016-0364
Published: 2016-07-01
Description: IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg2C1000152; http://www-01.ibm.com/support/docview.wss?uid=swg2C1000152
CVE: CVE-2016-0365
Published: 2016-07-01
Description: IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows remote attackers to bypass authentication and obtain sensitive artifact information via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg2C1000149; http://www.securityfocus.com/bid/91526; http://www-01.ibm.com/support/docview.wss?uid=swg2C1000149
CVE: CVE-2016-0374
Published: 2016-07-01
Description: The builder tools in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981729; http://www-01.ibm.com/support/docview.wss?uid=swg21981729
CVE: CVE-2016-0375
Published: 2016-07-01
Description: JMS Client in IBM MessageSight 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT15674; http://www-01.ibm.com/support/docview.wss?uid=swg1IT15743; http://www-01.ibm.com/support/docview.wss?uid=swg21985064
CVE: CVE-2016-0386
Published: 2016-07-02
Description: Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV83657; http://www-01.ibm.com/support/docview.wss?uid=swg1IV83657
CVE: CVE-2016-0387
Published: 2016-07-02
Description: Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2883.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981740; http://www-01.ibm.com/support/docview.wss?uid=swg21981740
CVE: CVE-2016-0391
Published: 2016-07-02
Description: The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21982615; http://www-01.ibm.com/support/docview.wss?uid=swg21982615
CVE: CVE-2016-0398
Published: 2016-07-02
Description: IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21977070; http://www-01.ibm.com/support/docview.wss?uid=swg21977070
CVE: CVE-2016-0399
Published: 2016-07-02
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984134; http://www-01.ibm.com/support/docview.wss?uid=swg21984134
CVE: CVE-2016-0400
Published: 2016-07-02
Description: CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI60897; http://www-01.ibm.com/support/docview.wss?uid=swg1PI60898; http://www-01.ibm.com/support/docview.wss?uid=swg21983036
CVE: CVE-2016-1289
Published: 2016-07-02
Description: The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID CSCuy10231.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-piauthbypass; http://www.securityfocus.com/bid/91504; http://www.securitytracker.com/id/1036195
CVE: CVE-2016-1408
Published: 2016-07-02
Description: Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request, aka Bug ID CSCuz01488.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-pi-epnm; http://www.securityfocus.com/bid/91506; http://www.securitytracker.com/id/1036197
CVE: CVE-2016-1416
Published: 2016-07-02
Description: Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administrator privileges via a crafted login attempt, aka Bug ID CSCuv37513.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-cpcpauthbypass; http://www.securityfocus.com/bid/91505; http://www.securitytracker.com/id/1036212
CVE: CVE-2016-1440
Published: 2016-07-02
Description: The proxy process on Cisco Web Security Appliance (WSA) devices through 9.1.0-070 allows remote attackers to cause a denial of service (CPU consumption) by establishing an FTP session and then improperly terminating the control connection after a file transfer, aka Bug ID CSCuy43468.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160627-wsa; http://www.securitytracker.com/id/1036188; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160627-wsa
CVE: CVE-2016-2861
Published: 2016-07-02
Description: IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI60897; http://www-01.ibm.com/support/docview.wss?uid=swg1PI60898; http://www-01.ibm.com/support/docview.wss?uid=swg21983036
CVE: CVE-2016-2867
Published: 2016-07-02
Description: IBM InfoSphere Streams before 4.0.1.2 and IBM Streams before 4.1.1.1 do not properly implement the runAsUser feature, which allows local users to obtain root group privileges via unspecified vectors.
CVSS Score: 7.0 (HIGH)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983444; http://www-01.ibm.com/support/docview.wss?uid=swg21983444
CVE: CVE-2016-2868
Published: 2016-07-02
Description: IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 2.7 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985774; http://www-01.ibm.com/support/docview.wss?uid=swg21985774
CVE: CVE-2016-2870
Published: 2016-07-02
Description: Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors.
CVSS Score: 2.7 (LOW)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT14815; http://www-01.ibm.com/support/docview.wss?uid=swg21983035; http://www.securityfocus.com/bid/91551
CVE: CVE-2016-2872
Published: 2016-07-02
Description: Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985775; http://www-01.ibm.com/support/docview.wss?uid=swg21985775
CVE: CVE-2016-2882
Published: 2016-07-02
Description: IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to obtain sensitive information by reading HTTP responses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983343; http://www.securityfocus.com/bid/91552; http://www-01.ibm.com/support/docview.wss?uid=swg21983343
CVE: CVE-2016-2883
Published: 2016-07-02
Description: Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0387.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983347; http://www-01.ibm.com/support/docview.wss?uid=swg21983347
CVE: CVE-2016-2961
Published: 2016-07-02
Description: The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT15188; http://www-01.ibm.com/support/docview.wss?uid=swg21985017; http://www-01.ibm.com/support/docview.wss?uid=swg1IT15188
CVE: CVE-2016-2968
Published: 2016-07-02
Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985773; http://www-01.ibm.com/support/docview.wss?uid=swg21985773
CVE: CVE-2016-3956
Published: 2016-07-02
Description: The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://blog.npmjs.org/post/[PII_REDACTED]5/fixing-a-bearer-token-vulnerability; http://www-01.ibm.com/support/docview.wss?uid=swg21980827; https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29
CVE: CVE-2016-4560
Published: 2016-07-02
Description: Untrusted search path vulnerability in Flexera InstallAnywhere allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
CVSS Score: 7.8 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984949; http://www-01.ibm.com/support/docview.wss?uid=swg21985483; http://www.securityfocus.com/bid/90979
CVE: CVE-2015-6931
Published: 2016-07-03
Description: Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1036112; http://www.vmware.com/security/advisories/VMSA-2016-0009.html; http://www.securitytracker.com/id/1036112
CVE: CVE-2015-7029
Published: 2016-07-03
Description: Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jun/msg00000.html; http://www.securitytracker.com/id/1036136; https://support.apple.com/HT206849
CVE: CVE-2016-1394
Published: 2016-07-03
Description: Cisco Firepower System Software 6.0.0 through 6.1.0 has a hardcoded account, which allows remote attackers to obtain CLI access by leveraging knowledge of the password, aka Bug ID CSCuz56238.
CVSS Score: 8.6 (HIGH)
CWE: CWE-255, CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-fp; http://www.securityfocus.com/bid/91503; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-fp
CVE: CVE-2016-1441
Published: 2016-07-03
Description: Cisco Cloud Network Automation Provisioner (CNAP) 1.0(0) in Cisco Configuration Assistant (CCA) allows remote attackers to bypass intended filesystem and administrative-endpoint restrictions via GET API calls, aka Bug ID CSCuy77145.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160630-cca; http://www.securityfocus.com/bid/91523; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160630-cca
CVE: CVE-2016-1606
Published: 2016-07-03
Description: Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (2) the CPName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (3) the PrinterName property value to ProfileEditor.PrintPasteControl in ProfEdit.dll, (4) the Data argument to the WriteRecords function in FTXBIFFLib.AS400FtxBIFF in FtxBIFF.dll, (5) the Serialized property value to NMSECCOMPARAMSLib.SSL3 in NMSecComParams.dll, (6) the UserName property value to NMSECCOMPARAMSLib.FirewallProxy in NMSecComParams.dll, (7) the LUName property value to ProfileEditor.MFSNAControl in ProfEdit.dll, (8) the newVal argument to the Load function in FTPSFTPLib.SFtpSession in FTPSFtp.dll, or (9) a long Host field in the FTP Client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28601.rumba-9-4-stack-buffer-overflow-vulnerabilities.aspx; http://www.securityfocus.com/bid/91548; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php
CVE: CVE-2016-2079
Published: 2016-07-03
Description: VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3, when the SSL-VPN feature is configured, allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036077; http://www.vmware.com/security/advisories/VMSA-2016-0007.html; http://www.securitytracker.com/id/1036077
CVE: CVE-2016-2081
Published: 2016-07-03
Description: Cross-site scripting (XSS) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1036078; http://www.vmware.com/security/advisories/VMSA-2016-0008.html; http://www.securitytracker.com/id/1036078
CVE: CVE-2016-2082
Published: 2016-07-03
Description: Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securitytracker.com/id/1036078; http://www.vmware.com/security/advisories/VMSA-2016-0008.html; http://www.securitytracker.com/id/1036078
CVE: CVE-2016-5228
Published: 2016-07-03
Description: Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument. NOTE: some references mention CVE-2016-5226 but that is not a correct ID for any Rumba vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28600.micro-focus-rumba-9-x-security-update.aspx; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2016-5701
Published: 2016-07-03
Description: setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html; http://www.debian.org/security/2016/dsa-3627
CVE: CVE-2016-5702
Published: 2016-07-03
Description: phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.
CVSS Score: 3.7 (LOW)
CWE: CWE-254
References: https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68; https://security.gentoo.org/glsa/201701-32; https://www.phpmyadmin.net/security/PMASA-2016-18/