deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5530
Published: 2015-07-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5248.php; https://www.exploit-db.com/exploits/37596/; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5248.php
CVE: CVE-2015-4266
Published: 2015-07-16
Description: The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39871; http://www.securitytracker.com/id/1032930; http://tools.cisco.com/security/center/viewAlert.x?alertId=39871
CVE: CVE-2015-4274
Published: 2015-07-16
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified Intelligence Center 10.0(1) and 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39920; http://www.securitytracker.com/id/1032962; http://tools.cisco.com/security/center/viewAlert.x?alertId=39920
CVE: CVE-2015-4275
Published: 2015-07-16
Description: The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet, aka Bug ID CSCut11534.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39934; http://www.securitytracker.com/id/1032984; http://tools.cisco.com/security/center/viewAlert.x?alertId=39934
CVE: CVE-2015-4276
Published: 2015-07-16
Description: Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39938; http://www.securityfocus.com/bid/75917; http://www.securitytracker.com/id/1032963
CVE: CVE-2015-4278
Published: 2015-07-16
Description: Cisco Email Security Appliance (ESA) devices with software 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a denial of service (per-domain e-mail reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain, aka Bug ID CSCuv14806.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39940; http://www.securitytracker.com/id/1032961; http://tools.cisco.com/security/center/viewAlert.x?alertId=39940
CVE: CVE-2015-5386
Published: 2015-07-16
Description: Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via unspecified HTTP requests.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-632547.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-195-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-632547.pdf
CVE: CVE-2015-4460
Published: 2015-07-16
Description: Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/535861/30/0/threaded; http://www.securityfocus.com/bid/75569; https://packetstormsecurity.com/files/132475/C2Box-4.0.0-r19171-Cross-Site-Request-Forgery.html
CVE: CVE-2015-0725
Published: 2015-07-16
Description: Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150715-vds; http://www.securitytracker.com/id/1032936; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150715-vds
CVE: CVE-2015-4528
Published: 2015-07-16
Description: Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/bugtraq/2015/Jul/80; http://www.securityfocus.com/bid/75929; http://www.securitytracker.com/id/1032966
CVE: CVE-2015-4529
Published: 2015-07-16
Description: Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 5.8 (MEDIUM)
References: http://seclists.org/bugtraq/2015/Jul/81; http://www.securityfocus.com/bid/75930; http://www.securitytracker.com/id/1032965
CVE: CVE-2015-3625
Published: 2015-07-18
Description: The NVIDIA GPU driver for FreeBSD R352 before 352.09, 346 before 346.72, R349 before 349.16, R343 before 343.36, R340 before 340.76, R337 before 337.25, R334 before 334.21, R331 before 331.113, and R304 before 304.125 allows local users with certain permissions to read or write arbitrary kernel memory via unspecified vectors that trigger an untrusted pointer dereference.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3693; http://www.securitytracker.com/id/1032981; http://nvidia.custhelp.com/app/answers/detail/a_id/3693
CVE: CVE-2015-0795
Published: 2015-07-18
Description: Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-340/; https://www.netiq.com/support/kb/doc.php?id=7016656; http://www.zerodayinitiative.com/advisories/ZDI-15-340/
CVE: CVE-2015-4280
Published: 2015-07-18
Description: Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request, aka Bug ID CSCum38844.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40003; http://www.securityfocus.com/bid/75931; http://www.securitytracker.com/id/1032968
CVE: CVE-2015-4458
Published: 2015-07-18
Description: The TLS implementation in the Cavium cryptographic-module firmware, as distributed with Cisco Adaptive Security Appliance (ASA) Software 9.1(5.21) and other products, does not verify the MAC field, which allows man-in-the-middle attackers to spoof TLS content by modifying packets, aka Bug ID CSCuu52976.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39919; http://www.securitytracker.com/id/1032927; http://tools.cisco.com/security/center/viewAlert.x?alertId=39919
CVE: CVE-2015-5374
Published: 2015-07-18
Description: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/75948; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-732541.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01
CVE: CVE-2015-2971
Published: 2015-07-19
Description: Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN64051989/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000098; http://www.acmailer.jp/info/de.cgi?id=58
CVE: CVE-2015-2972
Published: 2015-07-19
Description: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN19011483/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000099; http://sysphonic.com/en/thetis/THETIS-SEC-001.html
CVE: CVE-2014-8910
Published: 2015-07-20
Description: IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-74
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353; http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354; http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355
CVE: CVE-2014-9196
Published: 2015-07-20
Description: Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
CVSS Score: 7.6 (HIGH)
CWE: CWE-342, CWE-254
References: http://www.securityfocus.com/bid/75936; https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01; https://www.eaton.com/cybersecurity
CVE: CVE-2015-0130
Published: 2015-07-20
Description: Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert (RTC) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Requirements Composer (RRC) 4.x through 4.0.7; and Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960407; http://www-01.ibm.com/support/docview.wss?uid=swg21960407
CVE: CVE-2015-0157
Published: 2015-07-20
Description: IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) by leveraging an unspecified scalar function in a SQL statement.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT07103; http://www-01.ibm.com/support/docview.wss?uid=swg1IT07107; http://www-01.ibm.com/support/docview.wss?uid=swg1IT07108
CVE: CVE-2015-1883
Published: 2015-07-20
Description: IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT08075; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08080; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08085
CVE: CVE-2015-1922
Published: 2015-07-20
Description: The Data Movement implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to bypass intended access restrictions and delete table rows via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT08523; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08524; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08525
CVE: CVE-2015-1935
Published: 2015-07-20
Description: The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT08543; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08656; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08667
CVE: CVE-2015-1968
Published: 2015-07-20
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960244; http://www.securityfocus.com/bid/75476; http://www-01.ibm.com/support/docview.wss?uid=swg21960244
CVE: CVE-2015-1979
Published: 2015-07-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959695; http://www.securityfocus.com/bid/75538; http://www-01.ibm.com/support/docview.wss?uid=swg21959695
CVE: CVE-2015-1980
Published: 2015-07-20
Description: IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960244; http://www.securityfocus.com/bid/75143; http://www-01.ibm.com/support/docview.wss?uid=swg21960244
CVE: CVE-2015-1982
Published: 2015-07-20
Description: IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960244; http://www.securityfocus.com/bid/75477; http://www-01.ibm.com/support/docview.wss?uid=swg21960244
CVE: CVE-2015-1984
Published: 2015-07-20
Description: IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960244; http://www.securityfocus.com/bid/75474; http://www-01.ibm.com/support/docview.wss?uid=swg21960244
CVE: CVE-2015-4111
Published: 2015-07-20
Description: mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.blackberry.com/btsc/KB37207; http://www.securityfocus.com/bid/75950; http://www.securitytracker.com/id/1032969
CVE: CVE-2015-2418
Published: 2015-07-20
Description: Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://packetstormsecurity.com/files/163755/Microsoft-Windows-Malicious-Software-Removal-Tool-Privilege-Escalation.html; http://www.securitytracker.com/id/1032901; https://technet.microsoft.com/library/security/3074162
CVE: CVE-2015-2426
Published: 2015-07-20
Description: Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-124
References: http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/; http://www.kb.cert.org/vuls/id/103336; http://www.securityfocus.com/bid/75951
CVE: CVE-2015-0253
Published: 2015-07-20
Description: The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
CVSS Score: 5.0 (MEDIUM)
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
CVE: CVE-2015-2862
Published: 2015-07-20
Description: Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/919604; http://www.kb.cert.org/vuls/id/919604
CVE: CVE-2015-2863
Published: 2015-07-20
Description: Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/919604; http://www.kb.cert.org/vuls/id/919604
CVE: CVE-2015-3183
Published: 2015-07-20
Description: The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17, CWE-20
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2015-3185
Published: 2015-07-20
Description: The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
CVE: CVE-2015-4279
Published: 2015-07-20
Description: The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39990; http://www.securityfocus.com/bid/75953; http://www.securitytracker.com/id/1032999
CVE: CVE-2015-5124
Published: 2015-07-20
Description: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1214.html; http://www.securityfocus.com/bid/75959
CVE: CVE-2015-4245
Published: 2015-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2015-4246
Published: 2015-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2015-4247
Published: 2015-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2015-4283
Published: 2015-07-21
Description: Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40050; http://www.securityfocus.com/bid/75958; http://tools.cisco.com/security/center/viewAlert.x?alertId=40050
CVE: CVE-2015-2869
Published: 2015-07-21
Description: The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://blogs.cisco.com/security/talos/fileinfo-plugin-dos; http://totalcmd.net/plugring/fileinfo.html; http://www.kb.cert.org/vuls/id/813631