deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0175
Published: 2015-04-27
Description: IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI33008; http://www-01.ibm.com/support/docview.wss?uid=swg21697368; http://www.securitytracker.com/id/1032190
CVE: CVE-2015-1882
Published: 2015-04-27
Description: Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
CVSS Score: 8.5 (HIGH)
CWE: CWE-362
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357; http://www-01.ibm.com/support/docview.wss?uid=swg21697368; http://www.securityfocus.com/bid/74222
CVE: CVE-2015-1885
Published: 2015-04-27
Description: WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI33202; http://www-01.ibm.com/support/docview.wss?uid=swg1PI36211; http://www-01.ibm.com/support/docview.wss?uid=swg21697368
CVE: CVE-2015-2116
Published: 2015-04-27
Description: Unspecified vulnerability in HP Storage Data Protector 7.x before 7.03 build 107 allows remote authenticated users to execute arbitrary code or cause a denial of service via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.securityfocus.com/bid/74249; http://www.securitytracker.com/id/1032162; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04636829
CVE: CVE-2015-2117
Published: 2015-04-27
Description: HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/74285; http://www.securitytracker.com/id/1032187; http://zerodayinitiative.com/advisories/ZDI-15-154/
CVE: CVE-2015-2115
Published: 2015-04-27
Description: Unspecified vulnerability in HP Capture and Route Software (HPCR) 1.3 before Patch 7, 1.3 FP1 before Patch 1, and 1.4 before Patch 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 2.7 (LOW)
References: http://www.securityfocus.com/bid/74336; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04633710; http://www.securityfocus.com/bid/74336
CVE: CVE-2015-1774
Published: 2015-04-28
Description: The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156582.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157550.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00015.html
CVE: CVE-2015-1863
Published: 2015-04-28
Description: Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00000.html; http://packetstormsecurity.com/files/131598/Android-wpa_supplicant-Heap-Overflow.html; http://rhn.redhat.com/errata/RHSA-2015-1090.html
CVE: CVE-2015-3340
Published: 2015-04-28
Description: Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html
CVE: CVE-2015-1150
Published: 2015-04-28
Description: The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sending packets for which custom-rule blocking was intended.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00006.html; http://www.securitytracker.com/id/1032197; https://support.apple.com/HT204201
CVE: CVE-2015-1151
Published: 2015-04-28
Description: Wiki Server in Apple OS X Server before 4.1 allows remote attackers to bypass intended restrictions on Activity and People pages by connecting from an iPad client.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00006.html; http://www.securitytracker.com/id/1032196; https://support.apple.com/HT204201
CVE: CVE-2015-0708
Published: 2015-04-29
Description: Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38543; http://www.securitytracker.com/id/1032210; http://tools.cisco.com/security/center/viewAlert.x?alertId=38543
CVE: CVE-2015-0709
Published: 2015-04-29
Description: Cisco IOS 15.5S and IOS XE allow remote authenticated users to cause a denial of service (device crash) by leveraging knowledge of the RADIUS secret and sending crafted RADIUS packets, aka Bug ID CSCur21348.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38544; http://www.securitytracker.com/id/1032211; http://tools.cisco.com/security/center/viewAlert.x?alertId=38544
CVE: CVE-2015-0710
Published: 2015-04-29
Description: The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a denial of service (device reload) via a series of packets that are considered oversized and trigger improper fragmentation handling, aka Bug IDs CSCup37676 and CSCup30335.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38549; http://www.securitytracker.com/id/1032212; http://tools.cisco.com/security/center/viewAlert.x?alertId=38549
CVE: CVE-2015-0711
Published: 2015-04-29
Description: The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38557; http://www.securitytracker.com/id/1032213; http://tools.cisco.com/security/center/viewAlert.x?alertId=38557
CVE: CVE-2015-1321
Published: 2015-04-29
Description: Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.
CVSS Score: 6.8 (MEDIUM)
References: http://www.ubuntu.com/usn/USN-2570-1; http://www.ubuntu.com/usn/USN-2570-1
CVE: CVE-2015-1322
Published: 2015-04-29
Description: Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://www.ubuntu.com/usn/USN-2581-1; https://bugs.launchpad.net/ubuntu/%2Bsource/network-manager/%2Bbug/1449245; http://www.ubuntu.com/usn/USN-2581-1
CVE: CVE-2015-3026
Published: 2015-04-29
Description: Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163859.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164074.html
CVE: CVE-2015-3447
Published: 2015-04-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Apr/97; http://www.securityfocus.com/archive/1/535393/100/0/threaded; http://www.securityfocus.com/bid/74406
CVE: CVE-2015-3448
Published: 2015-04-29
Description: REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-04/msg00026.html; http://www.osvdb.org/117461; http://www.securityfocus.com/bid/74415
CVE: CVE-2015-1397
Published: 2015-04-29
Description: SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/; http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability; http://www.securitytracker.com/id/1032194
CVE: CVE-2015-1398
Published: 2015-04-29
Description: Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/; http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability; http://www.securitytracker.com/id/1032194
CVE: CVE-2015-1399
Published: 2015-04-29
Description: PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/; http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability; http://www.securitytracker.com/id/1032194
CVE: CVE-2015-3457
Published: 2015-04-29
Description: Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/; http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability; http://www.securityfocus.com/bid/74420
CVE: CVE-2015-3458
Published: 2015-04-29
Description: The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/; http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability; http://www.securityfocus.com/bid/74412
CVE: CVE-2015-3459
Published: 2015-04-29
Description: The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://hextechsecurity.com/?p=123; http://imgur.com/CEAnZjj; http://imgur.com/JHiWSqd
CVE: CVE-2015-0532
Published: 2015-05-01
Description: EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html; http://seclists.org/bugtraq/2015/Apr/204; http://www.securitytracker.com/id/1032218
CVE: CVE-2015-0712
Published: 2015-05-01
Description: The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets, aka Bug ID CSCud14217.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38580; http://www.securitytracker.com/id/1032219; http://tools.cisco.com/security/center/viewAlert.x?alertId=38580
CVE: CVE-2015-0912
Published: 2015-05-01
Description: EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://jvn.jp/en/jp/JVN67520407/995657/index.html; http://jvn.jp/en/jp/JVN67520407/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000060
CVE: CVE-2015-0913
Published: 2015-05-01
Description: Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN07538357/995657/index.html; http://jvn.jp/en/jp/JVN07538357/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000061
CVE: CVE-2015-0914
Published: 2015-05-01
Description: EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN96439865/995657/index.html; http://jvn.jp/en/jp/JVN96439865/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000062
CVE: CVE-2015-1243
Published: 2015-05-01
Description: Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00009.html; http://rhn.redhat.com/errata/RHSA-2015-0921.html
CVE: CVE-2015-1250
Published: 2015-05-01
Description: Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00009.html; http://rhn.redhat.com/errata/RHSA-2015-0921.html
CVE: CVE-2014-3598
Published: 2015-05-01
Description: The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html; https://pypi.python.org/pypi/Pillow/2.5.3; http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html
CVE: CVE-2014-8361
Published: 2015-05-01
Description: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVSS Score: 9.8 (CRITICAL)
References: http://jvn.jp/en/jp/JVN47580234/index.html; http://jvn.jp/en/jp/JVN67456944/index.html; http://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html
CVE: CVE-2015-0237
Published: 2015-05-01
Description: Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0888.html; http://www.securitytracker.com/id/1032231; http://rhn.redhat.com/errata/RHSA-2015-0888.html
CVE: CVE-2015-0257
Published: 2015-05-01
Description: Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0888.html; http://www.securitytracker.com/id/1032231; http://rhn.redhat.com/errata/RHSA-2015-0888.html
CVE: CVE-2015-2248
Published: 2015-05-01
Description: Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/131762/Dell-SonicWALL-Secure-Remote-Access-7.5-8.0-CSRF.html; http://www.scip.ch/en/?vuldb.75111; http://www.securityfocus.com/bid/73098
CVE: CVE-2015-3153
Published: 2015-05-01
Description: The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://curl.haxx.se/docs/adv_20150429.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2015-3337
Published: 2015-05-01
Description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html; http://www.debian.org/security/2015/dsa-3241; http://www.securityfocus.com/archive/1/535385
CVE: CVE-2015-3435
Published: 2015-05-01
Description: Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/74400; http://www.zerodayinitiative.com/advisories/ZDI-15-156/; http://www.zerodayinitiative.com/advisories/ZDI-15-157/
CVE: CVE-2015-3446
Published: 2015-05-01
Description: The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file (.cfg).
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/74403; http://www.zerodayinitiative.com/advisories/ZDI-15-161/; https://www.alienvault.com/forums/discussion/4415/
CVE: CVE-2015-3632
Published: 2015-05-01
Description: Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted GIF in a PDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/131685/Foxit-Reader-7.1.3.320-Memory-Corruption.html; http://protekresearchlab.com/PRL-2015-05/; http://www.foxitsoftware.com/support/security_bulletins.php#FRD-27
CVE: CVE-2015-3633
Published: 2015-05-01
Description: Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via vectors related to digital signatures.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-26; http://www.securityfocus.com/bid/74418; http://www.securitytracker.com/id/1032228
CVE: CVE-2015-0714
Published: 2015-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38607; http://www.securitytracker.com/id/1032222; http://tools.cisco.com/security/center/viewAlert.x?alertId=38607
CVE: CVE-2015-0531
Published: 2015-05-07
Description: EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/131748/EMC-SourceOne-Email-Management-Account-Lockout-Policy.html; http://seclists.org/bugtraq/2015/May/22; http://www.securitytracker.com/id/1032238
CVE: CVE-2015-0538
Published: 2015-05-07
Description: ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.
CVSS Score: 9.3 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/131749/EMC-AutoStart-5.4.3-5.5.0-Packet-Injection.html; http://seclists.org/bugtraq/2015/May/25; http://www.kb.cert.org/vuls/id/581276