deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5508
Published: 2015-08-18
Description: Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote attackers to hijack the authentication of users with the "administer ncip providers" permission for requests that alter NCIP providers via a crafted request.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75277; https://www.drupal.org/node/2507619
CVE: CVE-2015-5509
Published: 2015-08-18
Description: The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access to administration pages, which allows remote administrators to bypass intended restrictions via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75278; https://www.drupal.org/node/2430043
CVE: CVE-2015-5510
Published: 2015-08-18
Description: Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75281; https://www.drupal.org/node/2507753
CVE: CVE-2015-5511
Published: 2015-08-18
Description: The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75412; https://www.drupal.org/node/2511200
CVE: CVE-2015-5512
Published: 2015-08-18
Description: The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" user argument handler by substituting "me" for a user id in a URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://cgit.drupalcode.org/me/commit/?id=e28e5bf; http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75413
CVE: CVE-2015-5513
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login link.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2511278; https://www.drupal.org/node/2511280
CVE: CVE-2015-5514
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrate_ui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2516560; https://www.drupal.org/node/2516678
CVE: CVE-2015-5515
Published: 2015-08-18
Description: The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO enabled.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75547; https://www.drupal.org/node/2516680
CVE: CVE-2015-6517
Published: 2015-08-18
Description: Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication of users for requests that drop database tables via the droptable parameter to phpliteadmin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132580/phpLiteAdmin-1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535936/100/0/threaded; http://packetstormsecurity.com/files/132580/phpLiteAdmin-1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2015-6518
Published: 2015-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) droptable parameter, or (3) table parameter to phpliteadmin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132580/phpLiteAdmin-1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535936/100/0/threaded; http://packetstormsecurity.com/files/132580/phpLiteAdmin-1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2015-6519
Published: 2015-08-18
Description: SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132648/Arab-Portal-3-SQL-Injection.html; https://www.exploit-db.com/exploits/37594/; https://youtu.be/5nFblYE90Vk
CVE: CVE-2015-2502
Published: 2015-08-19
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://twitter.com/Laughing_Mantis/statuses/[PII_REDACTED]40841728; http://twitter.com/Laughing_Mantis/statuses/[PII_REDACTED]65886721; http://www.securityfocus.com/bid/76403
CVE: CVE-2015-4297
Published: 2015-08-19
Description: Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
CVSS Score: 5.8 (MEDIUM)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40427; http://www.securityfocus.com/bid/76328; http://tools.cisco.com/security/center/viewAlert.x?alertId=40427
CVE: CVE-2015-4302
Published: 2015-08-19
Description: The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40432; http://www.securityfocus.com/bid/76345; http://www.securitytracker.com/id/1033279
CVE: CVE-2015-1830
Published: 2015-08-19
Description: Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt; http://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html; http://www.securityfocus.com/bid/76452
CVE: CVE-2015-4298
Published: 2015-08-19
Description: Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40428; http://www.securityfocus.com/bid/76348; http://www.securitytracker.com/id/1033286
CVE: CVE-2015-4299
Published: 2015-08-19
Description: Cisco Unified Web and E-Mail Interaction Manager 9.0(2) improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders via unspecified vectors, aka Bug ID CSCuo89046.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40429; http://www.securityfocus.com/bid/74572; http://www.securitytracker.com/id/1033285
CVE: CVE-2015-4301
Published: 2015-08-19
Description: Cisco NX-OS on Nexus 9000 devices 11.1(1c) allows remote authenticated users to cause a denial of service (device hang) via large files that are copied to a device's filesystem, aka Bug ID CSCuu77225.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40431; http://www.securitytracker.com/id/1033267; http://tools.cisco.com/security/center/viewAlert.x?alertId=40431
CVE: CVE-2015-4308
Published: 2015-08-19
Description: The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40434; http://www.securityfocus.com/bid/76349; http://www.securitytracker.com/id/1033280
CVE: CVE-2015-4322
Published: 2015-08-19
Description: Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40450; http://www.securityfocus.com/bid/76365; http://www.securitytracker.com/id/1033322
CVE: CVE-2015-4324
Published: 2015-08-19
Description: Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(0)N1(0.1), and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to cause a denial of service (IGMP process restart) via a malformed IGMPv3 packet that is mishandled during memory allocation, aka Bug IDs CSCuv69713, CSCuv69717, CSCuv69723, CSCuv69732, and CSCuv48908.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40470; http://www.securityfocus.com/bid/76372; http://www.securitytracker.com/id/1033327
CVE: CVE-2015-5163
Published: 2015-08-19
Description: The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html; http://rhn.redhat.com/errata/RHSA-2015-1639.html; http://www.securityfocus.com/bid/76346
CVE: CVE-2015-5621
Published: 2015-08-19
Description: The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19, CWE-190
References: http://lists.opensuse.org/opensuse-updates/2015-09/msg00004.html; http://rhn.redhat.com/errata/RHSA-2015-1636.html; http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/
CVE: CVE-2015-6255
Published: 2015-08-19
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug ID CSCuo89051.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40555; http://www.securityfocus.com/bid/76406; http://www.securitytracker.com/id/1033330
CVE: CVE-2015-6522
Published: 2015-08-19
Description: SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wpvulndb.com/vulnerabilities/8140; https://www.exploit-db.com/exploits/37824/; https://wpvulndb.com/vulnerabilities/8140
CVE: CVE-2015-6523
Published: 2015-08-19
Description: Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2015/Jul/104; https://plugins.trac.wordpress.org/changeset/1175403/portfolio-by-lisa-westlund; https://wpvulndb.com/vulnerabilities/8108
CVE: CVE-2015-4277
Published: 2015-08-19
Description: The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39939; http://www.securitytracker.com/id/1033259; http://tools.cisco.com/security/center/viewAlert.x?alertId=39939
CVE: CVE-2015-4296
Published: 2015-08-19
Description: Nexus Data Broker (NDB) on Cisco Nexus 3000 devices with software 6.0(2)A6(1) allows remote attackers to cause a denial of service (Java process restart) via crafted connections to the Java application, aka Bug ID CSCut87006.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40426; http://www.securitytracker.com/id/1033264; http://tools.cisco.com/security/center/viewAlert.x?alertId=40426
CVE: CVE-2015-4310
Published: 2015-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40436; http://www.securityfocus.com/bid/76407; http://www.securitytracker.com/id/1033331
CVE: CVE-2015-4323
Published: 2015-08-19
Description: Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.9); Nexus 3000 devices 6.0(2)U5(1.41), 7.0(3)I2(0.373), and 7.3(0)ZN(0.83); Nexus 4000 devices 4.1(2)E1(1b); Nexus 7000 devices 6.2(14)S1; Nexus 9000 devices 7.3(0)ZN(0.9); and MDS 9000 devices 6.2 (13) and 7.1(0)ZN(91.99) and MDS SAN-OS 7.1(0)ZN(91.99) allows remote attackers to cause a denial of service (device outage) via a crafted ARP packet, related to incorrect MTU validation, aka Bug IDs CSCuv71933, CSCuv61341, CSCuv61321, CSCuu78074, CSCut37060, CSCuv61266, CSCuv61351, CSCuv61358, and CSCuv61366.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40469; http://www.securityfocus.com/bid/76367; http://www.securitytracker.com/id/1033321
CVE: CVE-2015-4314
Published: 2015-08-20
Description: The System Snapshot feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40439; http://www.securitytracker.com/id/1033266; http://tools.cisco.com/security/center/viewAlert.x?alertId=40439
CVE: CVE-2015-4315
Published: 2015-08-20
Description: The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40446; http://www.securityfocus.com/bid/76352; http://www.securitytracker.com/id/1033283
CVE: CVE-2015-4317
Published: 2015-08-20
Description: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40444; http://www.securityfocus.com/bid/76351; http://www.securitytracker.com/id/1033281
CVE: CVE-2015-4320
Published: 2015-08-20
Description: The Configuration Log File component in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40441; http://www.securityfocus.com/bid/76350; http://www.securitytracker.com/id/1033284
CVE: CVE-2015-4327
Published: 2015-08-20
Description: The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40518; http://www.securityfocus.com/bid/76408; http://www.securitytracker.com/id/1033332
CVE: CVE-2015-4328
Published: 2015-08-20
Description: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40522; http://www.securityfocus.com/bid/76399; http://www.securitytracker.com/id/1033329
CVE: CVE-2015-0533
Published: 2015-08-20
Description: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message, a similar issue to CVE-2014-3572.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://seclists.org/bugtraq/2015/Aug/84; http://www.securityfocus.com/bid/76377; http://seclists.org/bugtraq/2015/Aug/84
CVE: CVE-2015-0534
Published: 2015-08-20
Description: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, a similar issue to CVE-2014-8275.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://seclists.org/bugtraq/2015/Aug/84; http://www.securityfocus.com/bid/76377; http://www.securitytracker.com/id/1033297
CVE: CVE-2015-0535
Published: 2015-08-20
Description: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a similar issue to CVE-2015-0204.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://seclists.org/bugtraq/2015/Aug/84; http://www.securityfocus.com/bid/76377; http://seclists.org/bugtraq/2015/Aug/84
CVE: CVE-2015-0536
Published: 2015-08-20
Description: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero, a similar issue to CVE-2015-1787.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/bugtraq/2015/Aug/84; http://www.securityfocus.com/bid/76377; http://seclists.org/bugtraq/2015/Aug/84
CVE: CVE-2015-0537
Published: 2015-08-20
Description: Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service (memory corruption or segmentation fault) or possibly have unspecified other impact via crafted base64 data, a similar issue to CVE-2015-0292.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://seclists.org/bugtraq/2015/Aug/84; http://www.securityfocus.com/bid/76377; http://www.securitytracker.com/id/1033299
CVE: CVE-2015-0542
Published: 2015-08-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in EMC RSA Archer GRC 5.5 SP1 before P3 allow remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/bugtraq/2015/Aug/85; http://www.securityfocus.com/bid/76404; http://www.securitytracker.com/id/1033300
CVE: CVE-2015-4303
Published: 2015-08-20
Description: Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40433; http://www.securityfocus.com/bid/76322; http://www.securitytracker.com/id/1033268
CVE: CVE-2015-4316
Published: 2015-08-20
Description: The Mobile and Remote Access (MRA) endpoint-validation feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka Bug ID CSCuv40396.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40445; http://www.securityfocus.com/bid/76353; http://www.securitytracker.com/id/1033282
CVE: CVE-2015-4319
Published: 2015-08-20
Description: The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40442; http://www.securityfocus.com/bid/76366; http://www.securitytracker.com/id/1033323