deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3082
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3083 and CVE-2015-3085.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3083
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3084
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3086.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3085
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3083.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3086
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3084.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3087
Published: 2015-05-13
Description: Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3088
Published: 2015-05-13
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3089
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3090, and CVE-2015-3093.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3090
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3091
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3092.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3092
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3093
Published: 2015-05-13
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3090.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00016.html
CVE: CVE-2015-3456
Published: 2015-05-13
Description: The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
CVSS Score: 7.7 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e[PII_REDACTED]21f305d67bc0718795fedee2e824c; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html
CVE: CVE-2014-1900
Published: 2015-05-14
Description: Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.y-cam.com/y-cam-security-fix/; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850; http://www.y-cam.com/y-cam-security-fix/
CVE: CVE-2014-1901
Published: 2015-05-14
Description: Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp.  NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.y-cam.com/y-cam-security-fix/; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850; http://www.y-cam.com/y-cam-security-fix/
CVE: CVE-2014-1902
Published: 2015-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.y-cam.com/y-cam-security-fix/; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2014-007/?fid=3850; http://www.y-cam.com/y-cam-security-fix/
CVE: CVE-2015-3326
Published: 2015-05-14
Description: Trend Micro ScanMail for Microsoft Exchange (SMEX) 10.2 before Hot Fix Build 3318 and 11.0 before Hot Fix Build 4180 creates session IDs for the web console using a random number generator with predictable values, which makes it easier for remote attackers to bypass authentication via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.malerisch.net/2016/05/trendmicro-smex-session-predictable-cve-2015-3326.html; http://esupport.trendmicro.com/solution/en-US/1109669.aspx; http://www.securityfocus.com/bid/74661
CVE: CVE-2015-3397
Published: 2015-05-14
Description: Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74663; http://www.yiiframework.com/news/86/yii-2-0-4-is-released/; https://github.com/yiisoft/yii2/blob/2.0.4/framework/CHANGELOG.md
CVE: CVE-2015-3644
Published: 2015-05-14
Description: Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: http://www.debian.org/security/2015/dsa-3299; http://www.securityfocus.com/bid/74659; http://www.securitytracker.com/id/1032324
CVE: CVE-2015-0797
Published: 2015-05-14
Description: GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html
CVE: CVE-2015-2708
Published: 2015-05-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html
CVE: CVE-2015-2709
Published: 2015-05-14
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html
CVE: CVE-2015-2710
Published: 2015-05-14
Description: Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html
CVE: CVE-2015-2711
Published: 2015-05-14
Description: Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html; http://www.mozilla.org/security/announce/2015/mfsa2015-49.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-2712
Published: 2015-05-14
Description: The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html; http://www.mozilla.org/security/announce/2015/mfsa2015-50.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-2713
Published: 2015-05-14
Description: Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html
CVE: CVE-2015-2714
Published: 2015-05-14
Description: Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system, which allows attackers to obtain sensitive information via a crafted application that has a required permission for reading a log, as demonstrated by the READ_LOGS permission for the mixed-content violation log on Android 4.0 and earlier.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.mozilla.org/security/announce/2015/mfsa2015-52.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74611
CVE: CVE-2015-2715
Published: 2015-05-14
Description: Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html; http://www.mozilla.org/security/announce/2015/mfsa2015-53.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-2716
Published: 2015-05-14
Description: Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html
CVE: CVE-2015-2717
Published: 2015-05-14
Description: Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html; http://www.mozilla.org/security/announce/2015/mfsa2015-55.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-2718
Published: 2015-05-14
Description: The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html; http://www.mozilla.org/security/announce/2015/mfsa2015-56.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-2720
Published: 2015-05-14
Description: The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-17
References: http://www.mozilla.org/security/announce/2015/mfsa2015-58.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74611
CVE: CVE-2012-5849
Published: 2015-05-14
Description: Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an add_friend action to ajax.php; id parameter in a (2) share_object, (3) add_to_fav, (4) rating, or (5) flag_object action to ajax.php; cid parameter in an (6) add_new_item, (7) remove_collection_item, (8) get_item, or (9) load_more_items action to ajax.php; (10) ci_id parameter in a get_item action to ajax.php; user parameter to (11) user_contacts.php or (12) view_channel.php; (13) pid parameter to view_page.php; (14) tid parameter to view_topic.php; or (15) v parameter to watch_video.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0056.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0063.html; http://forums.clip-bucket.com/showthread.php?12527-Security-Fix-ClipBucket-2-6-SQL-Injections-fix-%28Updated%29
CVE: CVE-2014-8162
Published: 2015-05-14
Description: XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html; http://rhn.redhat.com/errata/RHSA-2015-0957.html; http://www.securityfocus.com/bid/74595
CVE: CVE-2015-0971
Published: 2015-05-14
Description: The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/; http://www.debian.org/security/2015/dsa-3254; http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/
CVE: CVE-2015-1848
Published: 2015-05-14
Description: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html