deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3135
Published: 2015-07-09
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-3136
Published: 2015-07-09
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-3137
Published: 2015-07-09
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4428
Published: 2015-07-09
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4430, and CVE-2015-5117.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4429
Published: 2015-07-09
Description: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-3126.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4430
Published: 2015-07-09
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4431
Published: 2015-07-09
Description: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-3134.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4432
Published: 2015-07-09
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-5118.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-4433
Published: 2015-07-09
Description: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, and CVE-2015-3122.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-5116
Published: 2015-07-09
Description: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-5117
Published: 2015-07-09
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-4430.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-5118
Published: 2015-07-09
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-4432.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html
CVE: CVE-2015-1793
Published: 2015-07-09
Description: The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
CVE: CVE-2015-4252
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence ISDN Gateway devices with software 2.2(1.106) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90724.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39795; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39795
CVE: CVE-2015-4253
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Serial Gateway devices with software 1.0(1.42) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90728.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39796; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39796
CVE: CVE-2015-4255
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90734.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39798; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39798
CVE: CVE-2015-4256
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP VCR devices with software 3.0(1.27) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90736.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39800; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39800
CVE: CVE-2015-4257
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MCU 4500 devices with software 4.5(1.55) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90710.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39801; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39801
CVE: CVE-2015-4258
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90444.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39802; http://www.securitytracker.com/id/1032838; http://tools.cisco.com/security/center/viewAlert.x?alertId=39802
CVE: CVE-2015-4244
Published: 2015-07-10
Description: The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for storage of these commands in a Compact Flash (CF) file, aka Bug ID CSCuu75278.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39677; http://www.securitytracker.com/id/1032839; http://tools.cisco.com/security/center/viewAlert.x?alertId=39677
CVE: CVE-2015-4260
Published: 2015-07-10
Description: Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu14862.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39804; http://www.securitytracker.com/id/1032840; http://tools.cisco.com/security/center/viewAlert.x?alertId=39804
CVE: CVE-2015-2967
Published: 2015-07-10
Description: Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN78187936/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000094; http://www.cacti.net/release_notes_0_8_8d.php
CVE: CVE-2015-2969
Published: 2015-07-10
Description: Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to inject arbitrary web script or HTML via the oekakis parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN67540183/995636/index.html; http://jvn.jp/en/jp/JVN67540183/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000096
CVE: CVE-2015-2970
Published: 2015-07-10
Description: index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN61935381/995636/index.html; http://jvn.jp/en/jp/JVN61935381/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000097
CVE: CVE-2015-4259
Published: 2015-07-10
Description: The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug IDs CSCum56133 and CSCum56177.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39803; http://www.securitytracker.com/id/1032872; http://tools.cisco.com/security/center/viewAlert.x?alertId=39803
CVE: CVE-2015-2963
Published: 2015-07-10
Description: The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN83881261/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000088; http://openwall.com/lists/oss-security/2015/06/19/3
CVE: CVE-2015-3650
Published: 2015-07-10
Description: vmware-vmx.exe in VMware Workstation 7.x through 10.x before 10.0.7 and 11.x before 11.1.1, VMware Player 5.x and 6.x before 6.0.7 and 7.x before 7.1.1, and VMware Horizon Client 5.x local-mode before 5.4.2 on Windows does not provide a valid DACL pointer during the setup of the vprintproxy.exe process, which allows host OS users to gain host OS privileges by injecting a thread.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.securitytracker.com/id/1032822; http://www.securitytracker.com/id/1032823; http://www.vmware.com/security/advisories/VMSA-2015-0005.html
CVE: CVE-2015-4254
Published: 2015-07-10
Description: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Advanced Media Gateway devices with software 1.1(1.40) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90732.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39797; http://tools.cisco.com/security/center/viewAlert.x?alertId=39797
CVE: CVE-2015-3199
Published: 2015-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a product. Notes: none.
CVE: CVE-2015-4236
Published: 2015-07-10
Description: Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service (clustering and SSH outage) via a packet flood, aka Bug IDs CSCur13704 and CSCuq05636.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39785; http://www.securityfocus.com/bid/75703; http://www.securitytracker.com/id/1032855
CVE: CVE-2015-4263
Published: 2015-07-10
Description: The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39825; http://www.securitytracker.com/id/1032854; http://tools.cisco.com/security/center/viewAlert.x?alertId=39825
CVE: CVE-2015-4526
Published: 2015-07-10
Description: EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://seclists.org/bugtraq/2015/Jul/59; http://www.securitytracker.com/id/1032853; http://seclists.org/bugtraq/2015/Jul/59
CVE: CVE-2015-4249
Published: 2015-07-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2015-1961
Published: 2015-07-13
Description: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR53356; http://www-01.ibm.com/support/docview.wss?uid=swg21959052; http://www.securityfocus.com/bid/75536
CVE: CVE-2015-8176
Published: 2015-07-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-8176.  Reason: This candidate is a duplicate of CVE-2014-8176.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-8176 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-5122
Published: 2015-07-14
Description: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html
CVE: CVE-2015-5123
Published: 2015-07-14
Description: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html
CVE: CVE-2015-1887
Published: 2015-07-14
Description: IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI36150; http://www-01.ibm.com/support/docview.wss?uid=swg21958024; http://www.securityfocus.com/bid/75475
CVE: CVE-2015-1917
Published: 2015-07-14
Description: Cross-site scripting (XSS) vulnerability in the Active Content Filtering component in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI38732; http://www-01.ibm.com/support/docview.wss?uid=swg21958024; http://www.securityfocus.com/bid/75479
CVE: CVE-2015-1944
Published: 2015-07-14
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI40341; http://www-01.ibm.com/support/docview.wss?uid=swg21958024; http://www.securityfocus.com/bid/75478
CVE: CVE-2015-4269
Published: 2015-07-14
Description: The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending many requests, aka Bug ID CSCuu99709.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39877; http://www.securitytracker.com/id/1032886; http://tools.cisco.com/security/center/viewAlert.x?alertId=39877