deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5882
Published: 2015-09-18
Description: The processor_set_tasks API implementation in Apple iOS before 9 allows local users to bypass an entitlement protection mechanism and obtain access to the task ports of arbitrary processes by leveraging root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-5885
Published: 2015-09-18
Description: The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level domain.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-5892
Published: 2015-09-18
Description: Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76764; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5895
Published: 2015-09-18
Description: Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76764; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5896
Published: 2015-09-18
Description: The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5903.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-5898
Published: 2015-09-18
Description: CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://www.securityfocus.com/bid/76764
CVE: CVE-2015-5899
Published: 2015-09-18
Description: libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-5903
Published: 2015-09-18
Description: The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5896.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-5904
Published: 2015-09-18
Description: Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76764; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5905
Published: 2015-09-18
Description: Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76764; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5906
Published: 2015-09-18
Description: The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which might make it easier for remote attackers to discover a password by leveraging a later prediction containing that character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76766; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5907
Published: 2015-09-18
Description: WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.
CVSS Score: 2.6 (LOW)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76766; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-5909
Published: 2015-09-18
Description: IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html; http://www.securitytracker.com/id/1033596; https://support.apple.com/HT205217
CVE: CVE-2015-5910
Published: 2015-09-18
Description: IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html; http://www.securitytracker.com/id/1033596; https://support.apple.com/HT205217
CVE: CVE-2015-5911
Published: 2015-09-18
Description: Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact via an XML document.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html; http://www.securitytracker.com/id/1033595; https://support.apple.com/HT205219
CVE: CVE-2015-5912
Published: 2015-09-18
Description: The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/archive/1/536488/100/0/threaded
CVE: CVE-2015-5916
Published: 2015-09-18
Description: The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html
CVE: CVE-2015-5920
Published: 2015-09-18
Description: The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html; http://www.securitytracker.com/id/1033617; https://support.apple.com/HT205221
CVE: CVE-2015-5921
Published: 2015-09-18
Description: WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html; http://www.securityfocus.com/bid/76766; http://www.securitytracker.com/id/1033609
CVE: CVE-2015-4638
Published: 2015-09-18
Description: The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 through 11.3.0, and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restart) via a fragmented packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1033578; https://support.f5.com/kb/en-us/solutions/public/17000/100/sol17155.html; http://www.securitytracker.com/id/1033578
CVE: CVE-2015-5274
Published: 2015-09-18
Description: rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://rhn.redhat.com/errata/RHSA-2015-1808.html; http://rhn.redhat.com/errata/RHSA-2015-1808.html
CVE: CVE-2015-7237
Published: 2015-09-18
Description: Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securitytracker.com/id/1033450; https://kc.mcafee.com/corporate/index?page=content&id=SB10130; http://www.securitytracker.com/id/1033450
CVE: CVE-2015-7238
Published: 2015-09-18
Description: The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10132; https://kc.mcafee.com/corporate/index?page=content&id=SB10132
CVE: CVE-2015-7239
Published: 2015-09-18
Description: SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/134801/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Dec/66; http://www.securityfocus.com/archive/1/537109/100/0/threaded
CVE: CVE-2015-6939
Published: 2015-09-18
Description: Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security-centre/[PII_REDACTED]8-core-xss-vulnerability.html; http://packetstormsecurity.com/files/133907/Joomla-CMS-3.4.3-Cross-Site-Scripting.html; http://www.securitytracker.com/id/1033541
CVE: CVE-2015-7243
Published: 2015-09-18
Description: Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133377/Boxoft-WAV-To-MP3-Converter-Buffer-Overflow.html; http://packetstormsecurity.com/files/137277/Boxoft-Wav-To-MP3-Converter-1.0-Buffer-Overflow.html; https://www.exploit-db.com/exploits/38035/
CVE: CVE-2015-3962
Published: 2015-09-18
Description: Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-522
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01
CVE: CVE-2015-6294
Published: 2015-09-18
Description: Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuu25770.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41006; http://www.securitytracker.com/id/1033612; http://tools.cisco.com/security/center/viewAlert.x?alertId=41006
CVE: CVE-2015-6296
Published: 2015-09-18
Description: Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by leveraging knowledge of the credentials, aka Bug ID CSCuw21825.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41041; http://www.securitytracker.com/id/1033613; http://tools.cisco.com/security/center/viewAlert.x?alertId=41041
CVE: CVE-2015-6297
Published: 2015-09-18
Description: The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun36525.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41060; http://www.securitytracker.com/id/1033614; http://tools.cisco.com/security/center/viewAlert.x?alertId=41060
CVE: CVE-2015-6456
Published: 2015-09-18
Description: GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.
CVSS Score: 9.0 (HIGH)
References: http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9; http://zerodayinitiative.com/advisories/ZDI-15-440/; https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03
CVE: CVE-2015-6459
Published: 2015-09-18
Description: Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9; http://zerodayinitiative.com/advisories/ZDI-15-439/; https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03
CVE: CVE-2015-6460
Published: 2015-09-18
Description: Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://zerodayinitiative.com/advisories/ZDI-15-441/; http://zerodayinitiative.com/advisories/ZDI-15-442/; https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02
CVE: CVE-2015-6932
Published: 2015-09-18
Description: VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.securitytracker.com/id/1033582; http://www.vmware.com/security/advisories/VMSA-2015-0006.html; http://www.securitytracker.com/id/1033582
CVE: CVE-2015-4304
Published: 2015-09-20
Description: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca; http://www.securitytracker.com/id/1033581; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca
CVE: CVE-2015-4305
Published: 2015-09-20
Description: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca; http://tools.cisco.com/security/center/viewAlert.x?alertId=40520; http://www.securitytracker.com/id/1033581
CVE: CVE-2015-4306
Published: 2015-09-20
Description: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca; http://www.securitytracker.com/id/1033581; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pca
CVE: CVE-2015-4307
Published: 2015-09-20
Description: The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pcp; http://www.securitytracker.com/id/1033579; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pcp
CVE: CVE-2015-6666
Published: 2015-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5638
Published: 2015-09-20
Description: Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN65602714/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000136; https://h2o.examp1e.net/vulnerabilities.html#CVE-2015-5638
CVE: CVE-2015-6284
Published: 2015-09-20
Description: Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a crafted URL, aka Bug ID CSCuu28277.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-tps; http://www.securitytracker.com/id/1033580; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-tps
CVE: CVE-2015-6295
Published: 2015-09-20
Description: Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40990; http://www.securitytracker.com/id/1033611; http://tools.cisco.com/security/center/viewAlert.x?alertId=40990
CVE: CVE-2015-6299
Published: 2015-09-20
Description: SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41074; http://www.securitytracker.com/id/1033622; http://tools.cisco.com/security/center/viewAlert.x?alertId=41074
CVE: CVE-2015-6300
Published: 2015-09-20
Description: Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or (2) GUI commands, aka Bug ID CSCuw24694.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41087; http://www.securitytracker.com/id/1033615; http://tools.cisco.com/security/center/viewAlert.x?alertId=41087
CVE: CVE-2015-6301
Published: 2015-09-20
Description: The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID CSCun72171.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41101; http://www.securitytracker.com/id/1033623; http://tools.cisco.com/security/center/viewAlert.x?alertId=41101
CVE: CVE-2015-5632
Published: 2015-09-20
Description: The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN73346595/995707/index.html; http://jvn.jp/en/jp/JVN73346595/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000130
CVE: CVE-2015-5633
Published: 2015-09-20
Description: The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN71815309/995707/index.html; http://jvn.jp/en/jp/JVN71815309/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000131
CVE: CVE-2015-5634
Published: 2015-09-20
Description: The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN83862346/995707/index.html; http://jvn.jp/en/jp/JVN83862346/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000132
CVE: CVE-2015-5635
Published: 2015-09-20
Description: The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN24517322/995707/index.html; http://jvn.jp/en/jp/JVN24517322/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000133
CVE: CVE-2015-5636
Published: 2015-09-20
Description: The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN67586379/995707/index.html; http://jvn.jp/en/jp/JVN67586379/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000134