deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-7889
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors, Retail Integrated 2x20 Display monitors, Retail Integrated 2x20 Complex monitors, POS Pole Display monitors, Graphical POS Pole Display monitors, and LCD Pole Display monitors, aka ZDI-CAN-2511.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7890
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSToneIndicator.ocx for POS keyboards and POS keyboards with MSR, aka ZDI-CAN-2510.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7891
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSKeyboard.ocx for POS keyboards and POS keyboards with MSR, aka ZDI-CAN-2509.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7892
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMSR.ocx for Mini MSR magnetic stripe readers, Retail Integrated Dual-Head MSR magnetic stripe readers, Integrated Single Head MSR w/o SRED magnetic stripe readers, Integrated Single Head w/o MSR SRED magnetic stripe readers, RP7 Single Head MSR w/o SRED magnetic stripe readers, POS keyboards, and POS keyboards with MSR, aka ZDI-CAN-2508.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7893
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2507.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7894
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSPrinter.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2506.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7895
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCashDrawer.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, Value Serial/USB Receipt printers, and USB Standard Duty cash drawers, aka ZDI-CAN-2505.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7897
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSScanner.ocx for Imaging Barcode scanners, Linear Barcode scanners, Presentation Barcode scanners, Retail Integrated Barcode scanners, Wireless Barcode scanners, and 2D Value Wireless scanners.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2014-7898
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840
CVE: CVE-2015-2206
Published: 2015-03-09
Description: libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html
CVE: CVE-2015-2242
Published: 2015-03-09
Description: Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130656/Webshop-Hun-1.062S-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/27; http://tetraph.com/security/sql-injection-vulnerability/webshop-hun-v1-062s-sql-injection-security-vulnerabilities/
CVE: CVE-2015-2243
Published: 2015-03-09
Description: Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/130653/Webshop-Hun-1.062S-Directory-Traversal.html; http://seclists.org/fulldisclosure/2015/Mar/26; http://tetraph.com/security/directory-traversal-vulnerability/webshop-hun-v1-062s-directory-traversal-security-vulnerabilities/
CVE: CVE-2015-2244
Published: 2015-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130648/Webshop-Hun-1.062S-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/25; http://tetraph.com/security/xss-vulnerability/webshop-hun-v1-062s-xss-cross-site-scripting-security-vulnerabilities/
CVE: CVE-2014-8105
Published: 2015-03-10
Description: 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html; http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
CVE: CVE-2014-8112
Published: 2015-03-10
Description: 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html; http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-9.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153991.html
CVE: CVE-2014-9566
Published: 2015-03-10
Description: Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/118746; http://packetstormsecurity.com/files/130637/Solarwinds-Orion-Service-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/18
CVE: CVE-2015-0201
Published: 2015-03-10
Description: The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: https://pivotal.io/security/cve-2015-0201; https://pivotal.io/security/cve-2015-0201
CVE: CVE-2015-0271
Published: 2015-03-10
Description: The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2015-0645.html; http://rhn.redhat.com/errata/RHSA-2015-0840.html; http://rhn.redhat.com/errata/RHSA-2015-0841.html
CVE: CVE-2015-2183
Published: 2015-03-10
Description: Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/89; http://seclists.org/oss-sec/2015/q1/649
CVE: CVE-2015-2184
Published: 2015-03-10
Description: ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/89; http://seclists.org/oss-sec/2015/q1/649
CVE: CVE-2015-2217
Published: 2015-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130684/Ultimate-PHP-Board-UPB-2.2.7-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534796/100/0/threaded; http://www.securityfocus.com/bid/72991
CVE: CVE-2015-1067
Published: 2015-03-11
Description: Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00001.html
CVE: CVE-2015-0005
Published: 2015-03-11
Description: The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://packetstormsecurity.com/files/130773/Windows-Pass-Through-Authentication-Methods-Improper-Validation.html; http://seclists.org/fulldisclosure/2015/Mar/60; http://www.coresecurity.com/advisories/windows-pass-through-authentication-methods-improper-validation
CVE: CVE-2015-0032
Published: 2015-03-11
Description: vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 8 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72910; http://www.securitytracker.com/id/1031887; http://www.securitytracker.com/id/1031888
CVE: CVE-2015-0056
Published: 2015-03-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72924; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-0073
Published: 2015-03-11
Description: The Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict changes to virtual stores, which allows local users to gain privileges via a crafted application, aka "Registry Virtualization Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72908; http://www.securitytracker.com/id/1031899; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-025
CVE: CVE-2015-0074
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly allocate memory, which allows remote attackers to cause a denial of service via a crafted (1) web site or (2) file, aka "Adobe Font Driver Denial of Service Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/72892; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0075
Published: 2015-03-11
Description: The kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Impersonation Level Check Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72915; http://www.securitytracker.com/id/1031899; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-025
CVE: CVE-2015-0076
Published: 2015-03-11
Description: The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72918; http://www.securitytracker.com/id/1031894; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-029
CVE: CVE-2015-0077
Published: 2015-03-11
Description: The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize function buffers, which allows local users to obtain sensitive information from kernel memory, and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72897; http://www.securitytracker.com/id/1031897; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-023
CVE: CVE-2015-0078
Published: 2015-03-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72902; http://www.securitytracker.com/id/1031897; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-023
CVE: CVE-2015-0079
Published: 2015-03-11
Description: The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to cause a denial of service (memory consumption and RDP outage) by establishing many RDP sessions that do not properly free allocated memory, aka "Remote Desktop Protocol (RDP) Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id/1031892; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-030; http://www.securitytracker.com/id/1031892
CVE: CVE-2015-0080
Published: 2015-03-11
Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72909; http://www.securitytracker.com/id/1031898; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-024
CVE: CVE-2015-0081
Published: 2015-03-11
Description: Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "WTS Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/72886; http://www.securitytracker.com/id/1031890; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-020
CVE: CVE-2015-0084
Published: 2015-03-11
Description: The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to bypass intended restrictions on launching executable files via a crafted task, aka "Task Scheduler Security Feature Bypass Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-254
References: http://www.securityfocus.com/bid/72913; http://www.securitytracker.com/id/1031893; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-028
CVE: CVE-2015-0085
Published: 2015-03-11
Description: Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.securitytracker.com/id/1031896; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022; http://www.securitytracker.com/id/1031896
CVE: CVE-2015-0086
Published: 2015-03-11
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, and Web Apps Server 2013 Gold and SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id/1031896; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022; http://www.securitytracker.com/id/1031896
CVE: CVE-2015-0087
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72893; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021