deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4828
Published: 2016-06-25
Description: The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-19
References: http://jvn.jp/en/jp/JVN61578437/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000118; http://www.welcart.com/community/archives/78977
CVE: CVE-2015-7987
Published: 2016-06-26
Description: Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr, (2) GetValueForMACAddr, (3) rfc3110_import, or (4) CopyNSEC3ResourceRecord function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/143335; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securityfocus.com/bid/91323
CVE: CVE-2015-7988
Published: 2016-06-26
Description: The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.kb.cert.org/vuls/id/143335; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1036181
CVE: CVE-2016-2901
Published: 2016-06-26
Description: Cross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI62594; http://www-01.ibm.com/support/docview.wss?uid=swg21983974; http://www.securitytracker.com/id/1036143
CVE: CVE-2016-4513
Published: 2016-06-26
Description: Cross-site scripting (XSS) vulnerability in the Schneider Electric PowerLogic PM8ECC module before 2.651 for PowerMeter 800 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-173-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-173-02
CVE: CVE-2016-5087
Published: 2016-06-26
Description: Alertus Desktop Notification before 2.9.31.1710 on OS X uses weak permissions for configuration files and unspecified other files, which allows local users to suppress emergency notifications or change content via standard filesystem operations.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/302544; http://www.kb.cert.org/vuls/id/BLUU-A9TJHR; http://www.kb.cert.org/vuls/id/302544
CVE: CVE-2015-7473
Published: 2016-06-26
Description: runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp.
CVSS Score: 2.5 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984555; http://www.securitytracker.com/id/1036180; http://www-01.ibm.com/support/docview.wss?uid=swg21984555
CVE: CVE-2016-0259
Published: 2016-06-26
Description: runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984561; http://www.securitytracker.com/id/1036179; http://www-01.ibm.com/support/docview.wss?uid=swg21984561
CVE: CVE-2016-0277
Published: 2016-06-26
Description: Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0278, CVE-2016-0279, and CVE-2016-0301.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983292; http://www.securitytracker.com/id/1036091; http://www-01.ibm.com/support/docview.wss?uid=swg21983292
CVE: CVE-2016-0278
Published: 2016-06-26
Description: Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0279, and CVE-2016-0301.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983292; http://www.securitytracker.com/id/1036091; http://www.talosintelligence.com/reports/TALOS-2016-0090/
CVE: CVE-2016-0279
Published: 2016-06-26
Description: Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0278, and CVE-2016-0301.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983292; http://www.securitytracker.com/id/1036091; http://www-01.ibm.com/support/docview.wss?uid=swg21983292
CVE: CVE-2016-0301
Published: 2016-06-26
Description: Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0278, and CVE-2016-0279.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983292; http://www.securitytracker.com/id/1036091; http://www-01.ibm.com/support/docview.wss?uid=swg21983292
CVE: CVE-2014-9903
Published: 2016-06-27
Description: The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4efbc454ba68def5ef285b26ebfcfdb605b52755; http://www.securityfocus.com/bid/91511; https://github.com/torvalds/linux/commit/4efbc454ba68def5ef285b26ebfcfdb605b52755
CVE: CVE-2014-9904
Published: 2016-06-27
Description: The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
CVE: CVE-2016-0758
Published: 2016-06-27
Description: Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-1583
Published: 2016-06-27
Description: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6d; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00027.html
CVE: CVE-2016-3707
Published: 2016-06-27
Description: The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Real Time 7 and other products, allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a cookie, or an attack that occurs after reading the local icmp_echo_sysrq file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
CVE: CVE-2016-3713
Published: 2016-06-27
Description: The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9842df62004f366b9fed2423e24df10542ee0dc5; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1; http://www.openwall.com/lists/oss-security/2016/05/16/2
CVE: CVE-2016-3949
Published: 2016-06-27
Description: Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and SIMATIC S7-300 Profinet-disabled CPU devices with firmware before 3.3.12 allow remote attackers to cause a denial of service (defect-mode transition) via crafted (1) ISO-TSAP or (2) Profibus packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id/1036089; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-818183.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-818183.pdf
CVE: CVE-2016-4440
Published: 2016-06-27
Description: arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ce424e45411cf5a13105e0386b6ecf6eeb4f66f; http://www.openwall.com/lists/oss-security/2016/05/20/2; https://bugzilla.redhat.com/show_bug.cgi?id=1337806
CVE: CVE-2016-4470
Published: 2016-06-27
Description: The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38327424b40bcebe2de92d07312c89360ac9229a; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html
CVE: CVE-2016-5243
Published: 2016-06-27
Description: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5d2be1422e02ccd697ccfcd45c85b4a26e6178e2; http://www.debian.org/security/2016/dsa-3607; http://www.openwall.com/lists/oss-security/2016/06/03/4
CVE: CVE-2016-5244
Published: 2016-06-27
Description: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-5728
Published: 2016-06-27
Description: Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9bf292bfca94694a721449e3fd[PII_REDACTED]10f6; http://www.debian.org/security/2016/dsa-3616; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1
CVE: CVE-2016-5828
Published: 2016-06-27
Description: The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
CVE: CVE-2016-5829
Published: 2016-06-27
Description: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc[PII_REDACTED]c20392d15c5; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
CVE: CVE-2016-0224
Published: 2016-06-28
Description: SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980989; http://www-01.ibm.com/support/docview.wss?uid=swg21980989
CVE: CVE-2016-0229
Published: 2016-06-28
Description: Cross-site scripting (XSS) vulnerability in IBM Marketing Platform 8.6.x and 9.x before 9.1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980989; http://www-01.ibm.com/support/docview.wss?uid=swg21980989
CVE: CVE-2016-0233
Published: 2016-06-28
Description: SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980989; http://www-01.ibm.com/support/docview.wss?uid=swg21980989
CVE: CVE-2015-8698
Published: 2016-06-29
Description: CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allows remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.1 (HIGH)
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx; http://www.securityfocus.com/bid/91497; http://www.securitytracker.com/id/1036193
CVE: CVE-2015-8699
Published: 2016-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx; http://www.securityfocus.com/bid/91497; http://www.securitytracker.com/id/1036193
CVE: CVE-2016-0260
Published: 2016-06-29
Description: Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984564; http://www-01.ibm.com/support/docview.wss?uid=swg21984564
CVE: CVE-2016-0263
Published: 2016-06-29
Description: IBM Spectrum Scale 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2 and General Parallel File System 3.5 before 3.5.0.30 allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005708; http://www.securityfocus.com/bid/90525; http://www.securitytracker.com/id/1036458
CVE: CVE-2016-0267
Published: 2016-06-29
Description: IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secure-property information via (1) the server UI or (2) a database request.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg2C1000151; http://www-01.ibm.com/support/docview.wss?uid=swg2C1000151
CVE: CVE-2016-0298
Published: 2016-06-29
Description: Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981749; http://www-01.ibm.com/support/docview.wss?uid=swg21981749
CVE: CVE-2016-0304
Published: 2016-06-29
Description: The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983328; http://www-01.ibm.com/support/docview.wss?uid=swg21983328
CVE: CVE-2012-6703
Published: 2016-06-29
Description: Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b35cc[PII_REDACTED]a616e3a2266d2fde5ab13d3ab; http://www.openwall.com/lists/oss-security/2016/06/28/6; http://www.securityfocus.com/bid/91502
CVE: CVE-2016-1237
Published: 2016-06-29
Description: nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=999653786df6954a31044528ac3f7a5dadca08f4; http://www.debian.org/security/2016/dsa-3607; http://www.openwall.com/lists/oss-security/2016/06/25/2
CVE: CVE-2016-5101
Published: 2016-06-29
Description: Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.opera.com/blogs/security/2016/02/opera-12-and-opera-mail-security-update/; http://www.securityfocus.com/bid/91507; http://www.opera.com/blogs/security/2016/02/opera-12-and-opera-mail-security-update/
CVE: CVE-2016-5832
Published: 2016-06-29
Description: The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91362; http://www.securitytracker.com/id/1036163
CVE: CVE-2016-5833
Published: 2016-06-29
Description: Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91368; http://www.securitytracker.com/id/1036163; https://codex.wordpress.org/Version_4.5.3
CVE: CVE-2016-5834
Published: 2016-06-29
Description: Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91368; http://www.securitytracker.com/id/1036163
CVE: CVE-2016-5835
Published: 2016-06-29
Description: WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91366; http://www.securitytracker.com/id/1036163
CVE: CVE-2016-5836
Published: 2016-06-29
Description: The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/91363; http://www.securitytracker.com/id/1036163; https://codex.wordpress.org/Version_4.5.3
CVE: CVE-2016-5837
Published: 2016-06-29
Description: WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91365; http://www.securitytracker.com/id/1036163
CVE: CVE-2016-5838
Published: 2016-06-29
Description: WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91367; http://www.securitytracker.com/id/1036163