deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5610
Published: 2015-07-21
Description: The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/912036; http://www.securityfocus.com/bid/75969; http://www.kb.cert.org/vuls/id/912036
CVE: CVE-2015-1905
Published: 2015-07-21
Description: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772; http://www-01.ibm.com/support/docview.wss?uid=swg21700717; http://www.securityfocus.com/bid/75977
CVE: CVE-2015-1906
Published: 2015-07-21
Description: Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52772; http://www-01.ibm.com/support/docview.wss?uid=swg21700717; http://www.securitytracker.com/id/1033002
CVE: CVE-2015-2134
Published: 2015-07-21
Description: Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://www.securityfocus.com/bid/75961; http://www.securitytracker.com/id/1033014
CVE: CVE-2015-4554
Published: 2015-07-21
Description: Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1033015; http://www.tibco.com/assets/blt1fd126faba191a9f/2015-001-advisory.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2015-5611
Published: 2015-07-21
Description: Unspecified vulnerability in Uconnect before 15.26.1, as used in certain Fiat Chrysler Automobiles (FCA) from 2013 to 2015 models, allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings via vectors related to modification of entertainment-system firmware and access of the CAN bus due to insufficient "Radio security protection," as demonstrated on a 2014 Jeep Cherokee Limited FWD.
CVSS Score: 8.3 (HIGH)
References: http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep/; http://media.fcanorthamerica.com/newsrelease.do?id=16827&mid=1; http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483033/RCAK-15V461-4967.pdf
CVE: CVE-2015-4651
Published: 2015-07-22
Description: The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing IP address strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2015-07/msg00020.html; http://www.debian.org/security/2015/dsa-3294; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2015-4652
Published: 2015-07-22
Description: epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2015-07/msg00020.html; http://www.debian.org/security/2015/dsa-3294; http://www.securityfocus.com/bid/75316
CVE: CVE-2015-5464
Published: 2015-07-22
Description: The Gemalto SafeNet Luna HSM allows remote authenticated users to bypass intended key-export restrictions by leveraging (1) crypto-user or (2) crypto-officer access to an HSM partition.
CVSS Score: 1.3 (LOW)
CWE: CWE-284
References: http://www.safenet-inc.com/technical-support/security-updates/; http://www.safenet-inc.com/technical-support/security-updates/
CVE: CVE-2014-0611
Published: 2015-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/kb/doc.php?id=7016653; http://www.securitytracker.com/id/1032978; https://bugzilla.novell.com/show_bug.cgi?id=909584
CVE: CVE-2015-4281
Published: 2015-07-22
Description: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.5 MR1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCus56150 and CSCus56146.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40021; http://www.securityfocus.com/bid/75979; http://www.securitytracker.com/id/1033016
CVE: CVE-2015-4284
Published: 2015-07-22
Description: The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets, aka Bug ID CSCur70670.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40067; http://www.securityfocus.com/bid/75980; http://www.securitytracker.com/id/1033017
CVE: CVE-2015-1270
Published: 2015-07-23
Description: The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-19
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1271
Published: 2015-07-23
Description: PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1272
Published: 2015-07-23
Description: Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1273
Published: 2015-07-23
Description: Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1274
Published: 2015-07-23
Description: Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1275
Published: 2015-07-23
Description: Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://www.securityfocus.com/bid/75973
CVE: CVE-2015-1276
Published: 2015-07-23
Description: Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1277
Published: 2015-07-23
Description: Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1278
Published: 2015-07-23
Description: content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1279
Published: 2015-07-23
Description: Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1280
Published: 2015-07-23
Description: SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1281
Published: 2015-07-23
Description: core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1282
Published: 2015-07-23
Description: Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1283
Published: 2015-07-23
Description: Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html
CVE: CVE-2015-1284
Published: 2015-07-23
Description: The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1285
Published: 2015-07-23
Description: The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1286
Published: 2015-07-23
Description: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1287
Published: 2015-07-23
Description: Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1288
Published: 2015-07-23
Description: The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-1289
Published: 2015-07-23
Description: Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-5605
Published: 2015-07-23
Description: The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1499.html
CVE: CVE-2015-4285
Published: 2015-07-23
Description: The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2, 5.1.3, 5.2.1, and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and UDP ports during the processing of flow base entries, which allows remote attackers to cause a denial of service (resource consumption) by sending traffic to these ports continuously, aka Bug ID CSCur88273.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40068; http://www.securitytracker.com/id/1033043; http://tools.cisco.com/security/center/viewAlert.x?alertId=40068
CVE: CVE-2015-4527
Published: 2015-07-23
Description: Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition (AVE) 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://seclists.org/bugtraq/2015/Jul/110; http://www.securitytracker.com/id/1033026; http://seclists.org/bugtraq/2015/Jul/110
CVE: CVE-2015-4235
Published: 2015-07-24
Description: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-apic; http://www.securitytracker.com/id/1033025; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-apic
CVE: CVE-2015-4262
Published: 2015-07-24
Description: The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.5(5) MR3 and 8.6 before 8.6(2) does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-mp; http://www.securitytracker.com/id/1033024; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-mp
CVE: CVE-2015-0681
Published: 2015-07-24
Description: The TFTP server in Cisco IOS 12.2(44)SQ1, 12.2(33)XN1, 12.4(25e)JAM1, 12.4(25e)JAO5m, 12.4(23)JY, 15.0(2)ED1, 15.0(2)EY3, 15.1(3)SVF4a, and 15.2(2)JB1 and IOS XE 2.5.x, 2.6.x, 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, and 3.5.xS before 3.6.0S; 3.1.xSG, 3.2.xSG, and 3.3.xSG before 3.4.0SG; 3.2.xSE before 3.3.0SE; 3.2.xXO before 3.3.0XO; 3.2.xSQ; 3.3.xSQ; and 3.4.xSQ allows remote attackers to cause a denial of service (device hang or reload) via multiple requests that trigger improper memory management, aka Bug ID CSCts66733.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-tftp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-tftp/cvrf/cisco-sa-20150722-tftp_cvrf.xml; http://www.securitytracker.com/id/1033023
CVE: CVE-2015-2973
Published: 2015-07-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN97971874/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000103; http://www.welcart.com/community/archives/74867