deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6751
Published: 2015-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) note added to a time entry or an (2) activity used to categorize time tracker entries.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cgit.drupalcode.org/time_tracker/commit/?id=436a638; https://www.drupal.org/node/2537296; https://www.drupal.org/node/2537866
CVE: CVE-2015-6752
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2553485; https://www.drupal.org/node/2553977; https://www.drupal.org/node/2553485
CVE: CVE-2015-6655
Published: 2015-08-31
Description: Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133299/Pligg-CMS-2.0.2-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/37955/; http://packetstormsecurity.com/files/133299/Pligg-CMS-2.0.2-Cross-Site-Request-Forgery.html
CVE: CVE-2015-6753
Published: 2015-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2546066; https://www.drupal.org/node/2546164; https://www.drupal.org/node/2546066
CVE: CVE-2015-6754
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2533510; https://www.drupal.org/node/2533926; https://www.drupal.org/node/2533510
CVE: CVE-2015-2135
Published: 2015-08-31
Description: Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04756070; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04756070
CVE: CVE-2015-4036
Published: 2015-08-31
Description: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719c; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
CVE: CVE-2015-6269
Published: 2015-08-31
Description: Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet, aka Bug ID CSCsw69990.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40686; http://www.securitytracker.com/id/1033410; http://tools.cisco.com/security/center/viewAlert.x?alertId=40686
CVE: CVE-2015-6270
Published: 2015-08-31
Description: Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet, aka Bug ID CSCsv98555.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40687; http://www.securitytracker.com/id/1033410; http://tools.cisco.com/security/center/viewAlert.x?alertId=40687
CVE: CVE-2015-6271
Published: 2015-08-31
Description: Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet, aka Bug IDs CSCta74749 and CSCta77008.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40688; http://www.securitytracker.com/id/1033410; http://tools.cisco.com/security/center/viewAlert.x?alertId=40688
CVE: CVE-2015-6272
Published: 2015-08-31
Description: Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet, aka Bug ID CSCsx35393, CSCsx07094, and CSCsw93064.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40689; http://www.securitytracker.com/id/1033410; http://tools.cisco.com/security/center/viewAlert.x?alertId=40689
CVE: CVE-2015-6526
Published: 2015-08-31
Description: The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a5cbce421a283e6aea3c4007f141735bf9da8c3; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2; http://www.openwall.com/lists/oss-security/2015/08/18/4
CVE: CVE-2013-7444
Published: 2015-09-01
Description: The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-2807
Published: 2015-09-01
Description: Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133350/WordPress-Navis-DocumentCloud-0.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Aug/78; https://security.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/
CVE: CVE-2015-6520
Published: 2015-09-01
Description: IPPUSBXD before 1.22 listens on all interfaces, which allows remote attackers to obtain access to USB connected printers via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/08/11/1; http://www.openwall.com/lists/oss-security/2015/08/18/11; http://www.ubuntu.com/usn/USN-2725-1
CVE: CVE-2015-6727
Published: 2015-09-01
Description: The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6728
Published: 2015-09-01
Description: The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6729
Published: 2015-09-01
Description: Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6730
Published: 2015-09-01
Description: Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6731
Published: 2015-09-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6732
Published: 2015-09-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit, the (2) "Template label (optional)" field in a form, or a (3) Field name in a template.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6733
Published: 2015-09-01
Description: GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6734
Published: 2015-09-01
Description: Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6735
Published: 2015-09-01
Description: The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6736
Published: 2015-09-01
Description: The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6737
Published: 2015-09-01
Description: Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html; http://www.openwall.com/lists/oss-security/2015/08/12/6; http://www.openwall.com/lists/oss-security/2015/08/27/6
CVE: CVE-2015-6587
Published: 2015-09-02
Description: The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3320; http://www.openafs.org/pages/security/OPENAFS-SA-2015-006.txt; https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html
CVE: CVE-2015-3308
Published: 2015-09-02
Description: Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155101.html; http://www.gnutls.org/security.html#GNUTLS-SA-2015-4; http://www.openwall.com/lists/oss-security/2015/04/15/6
CVE: CVE-2015-6805
Published: 2015-09-02
Description: Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8154; https://www.exploit-db.com/exploits/37907/; https://wpvulndb.com/vulnerabilities/8154
CVE: CVE-2015-4330
Published: 2015-09-02
Description: A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40541; http://www.securitytracker.com/id/1033442; http://tools.cisco.com/security/center/viewAlert.x?alertId=40541
CVE: CVE-2015-6274
Published: 2015-09-02
Description: The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv71273.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40708; http://www.securitytracker.com/id/1033437; http://tools.cisco.com/security/center/viewAlert.x?alertId=40708
CVE: CVE-2015-6277
Published: 2015-09-02
Description: The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7.3(0)ZD(0.61), and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices 7.0(0)HSK(0.353) allows remote attackers to cause a denial of service (ARP process restart) via crafted packet-header fields, aka Bug ID CSCut25292.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40748; http://www.securitytracker.com/id/1033443; http://tools.cisco.com/security/center/viewAlert.x?alertId=40748
CVE: CVE-2015-4077
Published: 2015-09-03
Description: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient; http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html; http://seclists.org/fulldisclosure/2015/Sep/0
CVE: CVE-2015-5189
Published: 2015-09-03
Description: Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2015-1700.html; https://bugzilla.redhat.com/show_bug.cgi?id=1252805; http://rhn.redhat.com/errata/RHSA-2015-1700.html
CVE: CVE-2015-5190
Published: 2015-09-03
Description: The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
CVSS Score: 8.5 (HIGH)
CWE: CWE-77
References: http://rhn.redhat.com/errata/RHSA-2015-1700.html; https://bugzilla.redhat.com/show_bug.cgi?id=1252813; http://rhn.redhat.com/errata/RHSA-2015-1700.html
CVE: CVE-2015-5735
Published: 2015-09-03
Description: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient; http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html; http://seclists.org/fulldisclosure/2015/Sep/0
CVE: CVE-2015-5736
Published: 2015-09-03
Description: The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient; http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html; http://seclists.org/fulldisclosure/2015/Sep/0
CVE: CVE-2015-5737
Published: 2015-09-03
Description: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry, which allows local users to obtain a privileged handle to a PID and possibly have unspecified other impact, as demonstrated by a 0x2220c8 ioctl call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient; http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html; http://seclists.org/fulldisclosure/2015/Sep/0
CVE: CVE-2015-6506
Published: 2015-09-03
Description: Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html
CVE: CVE-2015-6654
Published: 2015-09-03
Description: The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.debian.org/security/2015/dsa-3414; http://www.securitytracker.com/id/1033438; http://xenbits.xen.org/xsa/advisory-141.html
CVE: CVE-2015-1516
Published: 2015-09-03
Description: Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://adrianhayter.com/exploits.php; http://adrianhayter.com/exploits.php
CVE: CVE-2015-4552
Published: 2015-09-03
Description: Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://adrianhayter.com/exploits.php; http://blog.mybb.com/2015/05/27/mybb-1-8-5-1-6-17-merge-system-1-8-5-release/; http://www.securitytracker.com/id/1033471
CVE: CVE-2015-6545
Published: 2015-09-03
Description: Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133404/Cerb-7.0.3-Cross-Site-Request-Forgery.html; http://wiki.cerbweb.com/7.0#7.0.4; http://www.securityfocus.com/archive/1/536376/100/0/threaded
CVE: CVE-2015-1291
Published: 2015-09-03
Description: The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1292
Published: 2015-09-03
Description: The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
CVE: CVE-2015-1293
Published: 2015-09-03
Description: The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html