deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6139
Published: 2015-02-13
Description: The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391; http://www-01.ibm.com/support/docview.wss?uid=swg1JR51391
CVE: CVE-2014-6154
Published: 2015-02-13
Description: Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Windows allows remote attackers to access arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21696000; https://exchange.xforce.ibmcloud.com/vulnerabilities/97677; http://www-01.ibm.com/support/docview.wss?uid=swg21696000
CVE: CVE-2014-6185
Published: 2015-02-13
Description: dsmtca in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.2.3, 6.4 before 6.4.2.2, and 7.1 before 7.1.1.3 does not properly restrict shared-library loading, which allows local users to gain privileges via a crafted DSO file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05713; http://www-01.ibm.com/support/docview.wss?uid=swg21695715; https://exchange.xforce.ibmcloud.com/vulnerabilities/98521
CVE: CVE-2014-8385
Published: 2015-02-13
Description: Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-041-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-041-01
CVE: CVE-2014-8909
Published: 2015-02-13
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI30620; http://www-01.ibm.com/support/docview.wss?uid=swg21694738; https://exchange.xforce.ibmcloud.com/vulnerabilities/99250
CVE: CVE-2015-0593
Published: 2015-02-13
Description: The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0593; http://tools.cisco.com/security/center/viewAlert.x?alertId=37417; http://www.securityfocus.com/bid/72549
CVE: CVE-2015-0873
Published: 2015-02-13
Description: Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN96155055/index.html; http://jvn.jp/en/jp/JVN96155055/index.html
CVE: CVE-2013-2027
Published: 2015-02-13
Description: Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2015-0096.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00055.html; http://www.mandriva.com/security/advisories?name=MDVSA-2015:158
CVE: CVE-2014-0151
Published: 2015-02-13
Description: Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2015-0158.html; http://www.ovirt.org/OVirt_3.5_Release_Notes; https://bugzilla.redhat.com/show_bug.cgi?id=1077441
CVE: CVE-2014-0154
Published: 2015-02-13
Description: oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2015-0158.html; https://bugzilla.redhat.com/show_bug.cgi?id=1077450; http://rhn.redhat.com/errata/RHSA-2015-0158.html
CVE: CVE-2014-7827
Published: 2015-02-13
Description: The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0215.html; http://rhn.redhat.com/errata/RHSA-2015-0216.html; http://rhn.redhat.com/errata/RHSA-2015-0217.html
CVE: CVE-2014-7849
Published: 2015-02-13
Description: The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0215.html; http://rhn.redhat.com/errata/RHSA-2015-0216.html; http://rhn.redhat.com/errata/RHSA-2015-0217.html
CVE: CVE-2014-7853
Published: 2015-02-13
Description: The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote authenticated users to obtain sensitive information by leveraging access to the security-domain attribute.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2015-0215.html; http://rhn.redhat.com/errata/RHSA-2015-0216.html; http://rhn.redhat.com/errata/RHSA-2015-0217.html
CVE: CVE-2014-8122
Published: 2015-02-13
Description: Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2015-0215.html; http://rhn.redhat.com/errata/RHSA-2015-0216.html; http://rhn.redhat.com/errata/RHSA-2015-0217.html
CVE: CVE-2015-0245
Published: 2015-02-13
Description: D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://advisories.mageia.org/MGASA-2015-0071.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html; http://www.debian.org/security/2015/dsa-3161
CVE: CVE-2015-0255
Published: 2015-02-13
Description: X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2015-0073.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00085.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00086.html
CVE: CVE-2014-4804
Published: 2015-02-14
Description: Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695931; https://exchange.xforce.ibmcloud.com/vulnerabilities/95306; http://www-01.ibm.com/support/docview.wss?uid=swg21695931
CVE: CVE-2014-6195
Published: 2015-02-14
Description: The (1) Java GUI and (2) Web GUI components in the IBM Tivoli Storage Manager (TSM) Backup-Archive client 5.4 and 5.5 before 5.5.4.4 on AIX, Linux, and Solaris; 5.4.x and 5.5.x on Windows and z/OS; 6.1 before 6.1.5.7 on z/OS; 6.1 and 6.2 before 6.2.5.2 on Windows, before 6.2.5.3 on AIX and Linux x86, and before 6.2.5.4 on Linux Z and Solaris; 6.3 before 6.3.2.1 on AIX, before 6.3.2.2 on Windows, and before 6.3.2.3 on Linux; 6.4 before 6.4.2.1; and 7.1 before 7.1.1 in IBM TSM for Mail, when the Data Protection for Lotus Domino component is used, allow local users to bypass authentication and restore a Domino database or transaction-log backup via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT04249; http://www-01.ibm.com/support/docview.wss?uid=swg21695183; https://exchange.xforce.ibmcloud.com/vulnerabilities/98607
CVE: CVE-2014-8911
Published: 2015-02-14
Description: Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693329; https://exchange.xforce.ibmcloud.com/vulnerabilities/99252; http://www-01.ibm.com/support/docview.wss?uid=swg21693329
CVE: CVE-2015-0923
Published: 2015-02-14
Description: The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/377644; http://www.kb.cert.org/vuls/id/377644
CVE: CVE-2015-0931
Published: 2015-02-14
Description: Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74
References: http://www.kb.cert.org/vuls/id/377644; http://www.kb.cert.org/vuls/id/377644
CVE: CVE-2015-0517
Published: 2015-02-14
Description: The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html; http://www.securityfocus.com/bid/72501; http://www.securitytracker.com/id/1031693
CVE: CVE-2015-0518
Published: 2015-02-14
Description: The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html; http://www.securityfocus.com/bid/72502; http://www.securitytracker.com/id/1031693
CVE: CVE-2015-0519
Published: 2015-02-14
Description: The InputAccel Database (IADB) installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel (IA) SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2015-02/0043.html; http://packetstormsecurity.com/files/130284/EMC-Captiva-Capture-Sensitive-Information-Disclosure.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/100748
CVE: CVE-2015-0875
Published: 2015-02-15
Description: The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file.
CVSS Score: 1.8 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN48659722/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000016; http://www.okb.co.jp/okdirect/sp_passbook/information01.html
CVE: CVE-2014-7196
Published: 2015-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-7169.  Reason: This candidate is a duplicate of CVE-2014-7169.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-7169 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-7883
Published: 2015-02-15
Description: HP Universal CMDB (UCMDB) Probe 9.05, 10.01, and 10.11 enables the HTTP TRACE method, which allows remote attackers to obtain sensitive information by reading the headers of a response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/867593; http://www.securitytracker.com/id/1031688; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04553906
CVE: CVE-2015-1574
Published: 2015-02-15
Description: The Google Email application 4.2.2.0200 for Android allows remote attackers to cause a denial of service (persistent application crash) via a "Content-Disposition: ;" header in an e-mail message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://hmarco.org/bugs/google_email_app_4.2.2_denial_of_service.html; http://openwall.com/lists/oss-security/2015/02/10/9; http://openwall.com/lists/oss-security/2015/02/12/15
CVE: CVE-2014-0227
Published: 2015-02-16
Description: java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-19
References: http://advisories.mageia.org/MGASA-2015-0081.html; http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
CVE: CVE-2014-6113
Published: 2015-02-16
Description: Cross-site scripting (XSS) vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692516; https://exchange.xforce.ibmcloud.com/vulnerabilities/96210; http://www-01.ibm.com/support/docview.wss?uid=swg21692516
CVE: CVE-2014-6137
Published: 2015-02-16
Description: Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21692516; http://www.securityfocus.com/bid/72559; https://exchange.xforce.ibmcloud.com/vulnerabilities/96817
CVE: CVE-2015-0609
Published: 2015-02-16
Description: Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCuj96752.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0609; http://tools.cisco.com/security/center/viewAlert.x?alertId=37420; http://www.securityfocus.com/bid/72564
CVE: CVE-2015-1474
Published: 2015-02-16
Description: Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://packetstormsecurity.com/files/130778/Google-Android-Integer-Oveflow-Heap-Corruption.html; http://seclists.org/fulldisclosure/2015/Mar/63; http://www.securityfocus.com/bid/72788
CVE: CVE-2015-1608
Published: 2015-02-16
Description: Topline Opportunity Form (aka XLS Opp form) before 2015-02-15 does not properly restrict access to database-connection strings, which allows attackers to read the cleartext version of sensitive credential and e-mail address information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/669156; http://www.kb.cert.org/vuls/id/BLUU-9RUTH4; http://www.securityfocus.com/bid/72518
CVE: CVE-2014-9375
Published: 2015-02-16
Description: Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a ZIP archive.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://support.lexmark.com/index?page=content&id=TE677; http://www.zerodayinitiative.com/advisories/ZDI-15-046/; http://support.lexmark.com/index?page=content&id=TE677
CVE: CVE-2015-0260
Published: 2015-02-16
Description: RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/oss-sec/2015/q1/505; http://www.securityfocus.com/bid/72573; https://exchange.xforce.ibmcloud.com/vulnerabilities/100888
CVE: CVE-2015-0268
Published: 2015-02-16
Description: The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/72591; http://www.securitytracker.com/id/1031746; http://xenbits.xen.org/xsa/advisory-117.html
CVE: CVE-2015-1434
Published: 2015-02-16
Description: Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://mylittleforum.net/forum/index.php?id=8182; http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/archive/1/534681/100/0/threaded
CVE: CVE-2015-1435
Published: 2015-02-16
Description: Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mylittleforum.net/forum/index.php?id=8182; http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/archive/1/534681/100/0/threaded
CVE: CVE-2015-1436
Published: 2015-02-16
Description: Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534680/100/0/threaded; http://www.securityfocus.com/bid/72572
CVE: CVE-2015-1495
Published: 2015-02-16
Description: Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-033/; http://www.zerodayinitiative.com/advisories/ZDI-15-034/; https://portal.motorolasolutions.com/Support/US-EN/Resolution?solutionId=87666
CVE: CVE-2015-1496
Published: 2015-02-16
Description: Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.zerodayinitiative.com/advisories/ZDI-15-035/; http://www.zerodayinitiative.com/advisories/ZDI-15-036/; http://www.zerodayinitiative.com/advisories/ZDI-15-037/
CVE: CVE-2015-1497
Published: 2015-02-16
Description: radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/show/osvdb/118382; http://packetstormsecurity.com/files/130459/HP-Client-Automation-Command-Injection.html; http://www.exploit-db.com/exploits/36169
CVE: CVE-2015-1498
Published: 2015-02-16
Description: Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to (1) enumerate user accounts via a getUsers request, (2) assign a role to a user account via an addAssigneesToRole request, (3) remove a role from a user account via a removeAssigneesFromRole request, or (4) have other unspecified impact.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.zerodayinitiative.com/advisories/ZDI-15-039/; https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features; http://www.zerodayinitiative.com/advisories/ZDI-15-039/
CVE: CVE-2015-1499
Published: 2015-02-16
Description: The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www.zerodayinitiative.com/advisories/ZDI-15-041/; https://exchange.xforce.ibmcloud.com/vulnerabilities/100918; http://www.zerodayinitiative.com/advisories/ZDI-15-041/
CVE: CVE-2015-1500
Published: 2015-02-16
Description: Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via unspecified vectors to (1) graphManager.load or (2) factory.load.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-042/; http://www.zerodayinitiative.com/advisories/ZDI-15-044/; http://www.zerodayinitiative.com/advisories/ZDI-15-042/