deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6320
Published: 2016-01-15
Description: The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet, aka Bug ID CSCuv63138.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-aironet; http://www.securitytracker.com/id/1034668; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-aironet
CVE: CVE-2015-6323
Published: 2016-01-15
Description: The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors, aka Bug ID CSCuw34253.
CVSS Score: 9.8 (CRITICAL)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-ise; http://www.securitytracker.com/id/1034666; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-ise
CVE: CVE-2015-6336
Published: 2016-01-15
Description: Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to obtain access via unspecified vectors, aka Bug ID CSCuw58062.
CVSS Score: 7.3 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air; http://www.securitytracker.com/id/1034667; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air
CVE: CVE-2015-6423
Published: 2016-01-15
Description: The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic, aka Bug ID CSCuu67782.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160111-asa; http://www.securitytracker.com/id/1034644; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160111-asa
CVE: CVE-2015-6467
Published: 2016-01-15
Description: Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
CVSS Score: 8.1 (HIGH)
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2015-8279
Published: 2016-01-15
Description: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
CVSS Score: 8.6 (HIGH)
CWE: CWE-264
References: https://www.kb.cert.org/vuls/id/913000; https://www.kb.cert.org/vuls/id/913000
CVE: CVE-2015-8280
Published: 2016-01-15
Description: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.kb.cert.org/vuls/id/913000; https://www.kb.cert.org/vuls/id/913000
CVE: CVE-2015-8281
Published: 2016-01-15
Description: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://www.kb.cert.org/vuls/id/913000; https://www.kb.cert.org/vuls/id/913000
CVE: CVE-2016-0851
Published: 2016-01-15
Description: Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2016-0852
Published: 2016-01-15
Description: Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2016-0853
Published: 2016-01-15
Description: Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2016-0854
Published: 2016-01-15
Description: Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload; http://www.zerodayinitiative.com/advisories/ZDI-16-127; http://www.zerodayinitiative.com/advisories/ZDI-16-128
CVE: CVE-2016-0855
Published: 2016-01-15
Description: Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.zerodayinitiative.com/advisories/ZDI-16-122; http://www.zerodayinitiative.com/advisories/ZDI-16-123; http://www.zerodayinitiative.com/advisories/ZDI-16-124
CVE: CVE-2016-0856
Published: 2016-01-15
Description: Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-16-100; http://www.zerodayinitiative.com/advisories/ZDI-16-101; http://www.zerodayinitiative.com/advisories/ZDI-16-102
CVE: CVE-2016-0857
Published: 2016-01-15
Description: Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-16-107; http://www.zerodayinitiative.com/advisories/ZDI-16-119; http://www.zerodayinitiative.com/advisories/ZDI-16-121
CVE: CVE-2016-0858
Published: 2016-01-15
Description: Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-362
References: http://www.zerodayinitiative.com/advisories/ZDI-16-105; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; http://www.zerodayinitiative.com/advisories/ZDI-16-105
CVE: CVE-2016-0859
Published: 2016-01-15
Description: Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-189
References: http://www.zerodayinitiative.com/advisories/ZDI-16-104; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01; http://www.zerodayinitiative.com/advisories/ZDI-16-104
CVE: CVE-2016-0860
Published: 2016-01-15
Description: Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-16-058; http://www.zerodayinitiative.com/advisories/ZDI-16-074; https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
CVE: CVE-2016-1897
Published: 2016-01-15
Description: FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://habrahabr.ru/company/mailru/blog/274855; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html; http://security.stackexchange.com/questions/110644
CVE: CVE-2016-1898
Published: 2016-01-15
Description: FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://habrahabr.ru/company/mailru/blog/274855; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html; http://www.debian.org/security/2016/dsa-3506
CVE: CVE-2015-8675
Published: 2016-01-15
Description: Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physically proximate attackers to obtain sensitive password information by reading the display.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-255
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160112-01-switch-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160112-01-switch-en
CVE: CVE-2015-8685
Published: 2016-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/135256/dolibarr-HTML-Injection.html; http://seclists.org/fulldisclosure/2016/Jan/40; https://github.com/Dolibarr/dolibarr/issues/4291
CVE: CVE-2015-8688
Published: 2016-01-15
Description: Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://gultsch.de/gajim_roster_push_and_message_interception.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175503.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175526.html
CVE: CVE-2015-8749
Published: 2016-01-15
Description: The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/01/07/8; http://www.openwall.com/lists/oss-security/2016/01/07/9; http://www.securityfocus.com/bid/80189
CVE: CVE-2016-1256
Published: 2016-01-15
Description: Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R7, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D18 or 14.1X53-D30, 14.1X55 before 14.1X55-D25, 14.2 before 14.2R4, 15.1 before 15.1R2, and 15.1X49 before 15.1X49-D10 allow remote attackers to cause a denial of service via a malformed IGMPv3 packet, aka a "multicast denial of service."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10714; http://www.securitytracker.com/id/1035107; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10714
CVE: CVE-2016-1257
Published: 2016-01-15
Description: The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 before 14.1R3-S9, 14.1R4 before 14.1R4-S7, 14.1X51 before 14.1X51-D65, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D28, 14.1X53 before 4.1X53-D35, 14.2R1 before 14.2R5, 14.2R3 before 14.2R3-S4, 14.2R4 before 14.2R4-S1, 15.1 before 15.1R3, 15.1F2 before 15.1F2-S2, and 15.1X49 before 15.1X49-D40, when LDP is enabled, allows remote attackers to cause a denial of service (RPD routing process crash) via a crafted LDP packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10715; http://www.securitytracker.com/id/1035117; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10715
CVE: CVE-2016-1258
Published: 2016-01-15
Description: Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10720; http://www.securitytracker.com/id/1035116; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10720
CVE: CVE-2016-1260
Published: 2016-01-15
Description: Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to cause a denial of service (network loop and bandwidth consumption) via unspecified vectors related to Spanning Tree Protocol (STP) traffic.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10719; http://www.securitytracker.com/id/1035106; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10719
CVE: CVE-2016-1262
Published: 2016-01-15
Description: Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled, allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10721; http://www.securitytracker.com/id/1035108; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10721
CVE: CVE-2016-1909
Published: 2016-01-15
Description: Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortios; http://packetstormsecurity.com/files/135225/FortiGate-OS-5.0.7-SSH-Backdoor.html; http://seclists.org/fulldisclosure/2016/Jan/26
CVE: CVE-2016-1910
Published: 2016-01-15
Description: The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/Apr/60; http://www.securityfocus.com/bid/80920; https://erpscan.io/advisories/erpscan-16-003-sap-netweaver-7-4-cryptographic-issues/
CVE: CVE-2016-1911
Published: 2016-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime Workbench (RWB) or (2) Pmitest servlet in the Process Monitoring Infrastructure (PMI), aka SAP Security Notes 2206793 and 2234918.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2016/Apr/58; http://seclists.org/fulldisclosure/2016/Apr/64; https://erpscan.io/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/
CVE: CVE-2016-1912
Published: 2016-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email, (4) job, or (5) signature parameter to htdocs/user/card.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/135201/Dolibarr-3.8.3-Cross-Site-Scripting.html; http://www.information-security.fr/xss-dolibarr-version-3-8-3/; https://github.com/Dolibarr/dolibarr/issues/4341
CVE: CVE-2016-1913
Published: 2016-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors, related to (1) individual contacts, (2) notes, or (3) engagement scores.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/node/2649780; https://www.drupal.org/node/2649800; https://www.drupal.org/node/2649780
CVE: CVE-2015-6863
Published: 2016-01-16
Description: HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04941487; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04941487
CVE: CVE-2015-6864
Published: 2016-01-16
Description: HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04941487; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04941487
CVE: CVE-2016-1133
Published: 2016-01-16
Description: CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.
CVSS Score: 3.7 (LOW)
References: http://jvn.jp/en/jp/JVN45928828/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000003; https://github.com/h2o/h2o/issues/682
CVE: CVE-2016-1142
Published: 2016-01-16
Description: Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN50899877/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000002; http://www.acmailer.jp/info/de.cgi?id=64
CVE: CVE-2016-1293
Published: 2016-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Management Center in Cisco FireSIGHT System Software 6.0.0 and 6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCux40414.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-FireSIGHT; http://www.securitytracker.com/id/1034689; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-FireSIGHT
CVE: CVE-2016-1294
Published: 2016-01-16
Description: Cross-site scripting (XSS) vulnerability in the Management Center in Cisco FireSIGHT System Software 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted cookie, aka Bug ID CSCuw89094.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-fmc1; http://www.securitytracker.com/id/1034690; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-fmc1
CVE: CVE-2016-1295
Published: 2016-01-16
Description: Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote attackers to obtain sensitive information via an AnyConnect authentication attempt, aka Bug ID CSCuo65775.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-asa; http://www.securitytracker.com/id/1034691; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-asa
CVE: CVE-2015-4958
Published: 2016-01-17
Description: IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly restrict browser caching, which allows local users to obtain sensitive information by reading cache files.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971545; http://www-01.ibm.com/support/docview.wss?uid=swg21971545
CVE: CVE-2015-4960
Published: 2016-01-17
Description: IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971545; http://www-01.ibm.com/support/docview.wss?uid=swg21971545
CVE: CVE-2015-7414
Published: 2016-01-17
Description: Cross-site scripting (XSS) vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971545; http://www-01.ibm.com/support/docview.wss?uid=swg21971545
CVE: CVE-2015-7467
Published: 2016-01-17
Description: Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972485; http://www-01.ibm.com/support/docview.wss?uid=swg21972485
CVE: CVE-2015-7468
Published: 2016-01-17
Description: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended restrictions on administrator tasks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972485; http://www-01.ibm.com/support/docview.wss?uid=swg21972485
CVE: CVE-2015-7469
Published: 2016-01-17
Description: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972485; http://www-01.ibm.com/support/docview.wss?uid=swg21972485
CVE: CVE-2015-7470
Published: 2016-01-17
Description: Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as demonstrated by login information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972485; http://www-01.ibm.com/support/docview.wss?uid=swg21972485
CVE: CVE-2015-4942
Published: 2016-01-18
Description: IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4943.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21974169; http://www.securitytracker.com/id/1034698; http://www-01.ibm.com/support/docview.wss?uid=swg21974169