deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6287
Published: 2015-09-14
Description: Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40846; http://www.securityfocus.com/bid/76677; http://www.securitytracker.com/id/1033529
CVE: CVE-2015-6288
Published: 2015-09-14
Description: Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollover and application fault) via crafted HTTP requests, aka Bug ID CSCuw09620.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40847; http://www.securitytracker.com/id/1033505; http://tools.cisco.com/security/center/viewAlert.x?alertId=40847
CVE: CVE-2015-6290
Published: 2015-09-14
Description: Cisco Web Security Appliance (WSA) 8.0.7 allows remote HTTP servers to cause a denial of service (memory consumption from stale TCP connections) via crafted responses, aka Bug ID CSCuw10426.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40896; http://www.securityfocus.com/bid/76687; http://www.securitytracker.com/id/1033530
CVE: CVE-2015-6830
Published: 2015-09-14
Description: libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html
CVE: CVE-2015-5997
Published: 2015-09-14
Description: Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data.
CVSS Score: 7.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/549807; http://www.kb.cert.org/vuls/id/549807
CVE: CVE-2015-5998
Published: 2015-09-14
Description: Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/549807; http://www.kb.cert.org/vuls/id/549807
CVE: CVE-2014-9745
Published: 2015-09-14
Description: The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=df14e6c0b9592cbb24d5381dfc6106b14f915e75; http://lists.opensuse.org/opensuse-updates/2015-10/msg00017.html; http://savannah.nongnu.org/bugs/index.php?41590
CVE: CVE-2015-1943
Published: 2015-09-14
Description: IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI39617; http://www-01.ibm.com/support/docview.wss?uid=swg21962567; http://www.securitytracker.com/id/1033444
CVE: CVE-2015-4980
Published: 2015-09-14
Description: Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54107; http://www-01.ibm.com/support/docview.wss?uid=swg21965013; http://www.securitytracker.com/id/1033447
CVE: CVE-2015-4947
Published: 2015-09-15
Description: Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44793; http://www-01.ibm.com/support/docview.wss?uid=swg1PI45596; http://www-01.ibm.com/support/docview.wss?uid=swg21965419
CVE: CVE-2015-5472
Published: 2015-09-15
Description: Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.vapid.dhs.org/advisory.php?v=137; https://wordpress.org/plugins/ibs-mappro/changelog/; https://wpvulndb.com/vulnerabilities/8091
CVE: CVE-2015-6943
Published: 2015-09-15
Description: SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://blog.curesec.com/article/blog/Serendipity-201-Blind-SQL-Injection-52.html; http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html; http://packetstormsecurity.com/files/133428/Serendipity-2.0.1-Blind-SQL-Injection.html
CVE: CVE-2015-6944
Published: 2015-09-15
Description: Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of users for requests that execute arbitrary SQL commands via the cmd parameter to sys/sys/listaBD2.jsp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt; http://packetstormsecurity.com/files/133466/JSPMySQL-Administrador-1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536406/100/0/threaded
CVE: CVE-2015-6945
Published: 2015-09-15
Description: Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via the bd parameter to sys/sys/listaBD2.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt; http://packetstormsecurity.com/files/133466/JSPMySQL-Administrador-1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536406/100/0/threaded
CVE: CVE-2015-6946
Published: 2015-09-15
Description: Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the activate_doit function or (3) licfile parameter to the service_startup_doit functionality.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-412; http://www.zerodayinitiative.com/advisories/ZDI-15-414/; http://www.zerodayinitiative.com/advisories/ZDI-15-416
CVE: CVE-2015-6947
Published: 2015-09-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-6946. Reason: This issue was MERGED into CVE-2015-6946 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2015-6946 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-6948
Published: 2015-09-15
Description: Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033559; http://www.zerodayinitiative.com/advisories/ZDI-15-410; http://www.securitytracker.com/id/1033559
CVE: CVE-2015-6949
Published: 2015-09-15
Description: Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033560; http://www.zerodayinitiative.com/advisories/ZDI-15-409; http://www.securitytracker.com/id/1033560
CVE: CVE-2015-5197
Published: 2015-09-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5426
Published: 2015-09-16
Description: Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2756.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securitytracker.com/id/1033561; http://www.zerodayinitiative.com/advisories/ZDI-15-408; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04692147
CVE: CVE-2015-2136
Published: 2015-09-16
Description: HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762372; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762372
CVE: CVE-2015-5440
Published: 2015-09-16
Description: HP UCMDB 10.00 and 10.01 before 10.01CUP12, 10.10 and 10.11 before 10.11CUP6, and 10.2x before 10.21 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033528; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790231; http://www.securitytracker.com/id/1033528
CVE: CVE-2015-5956
Published: 2015-09-16
Description: The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133551/Typo3-CMS-6.2.14-4.5.40-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/57; http://www.securityfocus.com/archive/1/536464/100/0/threaded
CVE: CVE-2015-6828
Published: 2015-09-16
Description: The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/09/05/4; http://www.openwall.com/lists/oss-security/2015/09/06/3; https://wpvulndb.com/vulnerabilities/8179
CVE: CVE-2015-6829
Published: 2015-09-16
Description: Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2015/09/05/4; http://www.openwall.com/lists/oss-security/2015/09/06/3; https://plugins.trac.wordpress.org/changeset/1239492/wp-limit-login-attempts
CVE: CVE-2015-6965
Published: 2015-09-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133463/WordPress-Contact-Form-Generator-2.0.1-CSRF.html; https://wpvulndb.com/vulnerabilities/8176; https://www.exploit-db.com/exploits/38086/
CVE: CVE-2015-6966
Published: 2015-09-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.curesec.com/article/blog/NibbleBlog-403-CSRF-46.html; http://blog.nibbleblog.com/post/nibbleblog-v4-0-5/; http://seclists.org/fulldisclosure/2015/Sep/4
CVE: CVE-2015-6967
Published: 2015-09-16
Description: Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.
CVSS Score: 6.5 (MEDIUM)
References: http://blog.curesec.com/article/blog/NibbleBlog-403-Code-Execution-47.html; http://blog.nibbleblog.com/post/nibbleblog-v4-0-5/; http://packetstormsecurity.com/files/133425/NibbleBlog-4.0.3-Shell-Upload.html
CVE: CVE-2015-6968
Published: 2015-09-16
Description: Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
CVSS Score: 6.5 (MEDIUM)
References: http://blog.curesec.com/article/blog/Serendipity-201-Code-Execution-48.html; http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html; http://packetstormsecurity.com/files/133426/Serendipity-2.0.1-Shell-Upload.html
CVE: CVE-2015-6969
Published: 2015-09-16
Description: Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.curesec.com/article/blog/Serendipity-201-Persistent-XSS-51.html; http://blog.s9y.org/archives/265-Serendipity-2.0.2-Security-Fix-Release.html; http://packetstormsecurity.com/files/133427/Serendipity-2.0.1-Cross-Site-Scripting.html
CVE: CVE-2014-8778
Published: 2015-09-16
Description: Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html; http://seclists.org/fulldisclosure/2015/Sep/17; http://www.securityfocus.com/archive/1/536387/100/0/threaded
CVE: CVE-2015-1173
Published: 2015-09-16
Description: Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/133147/UNIT4TETA-TETA-WEB-22.62.3.4-Authorization-Bypass.html; http://seclists.org/fulldisclosure/2015/Aug/68; http://packetstormsecurity.com/files/133147/UNIT4TETA-TETA-WEB-22.62.3.4-Authorization-Bypass.html
CVE: CVE-2015-3623
Published: 2015-09-16
Description: XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
CVSS Score: 6.4 (MEDIUM)
References: http://packetstormsecurity.com/files/133499/Qlikview-11.20-SR4-Blind-XXE-Injection.html; http://www.securityfocus.com/archive/1/536411/100/0/threaded; https://www.exploit-db.com/exploits/38118/
CVE: CVE-2015-5465
Published: 2015-09-16
Description: Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allows local users to gain privileges via a crafted (1) 0x96002400 or (2) 0x96002404 IOCTL call.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/133399/SiS-Windows-VGA-Display-Manager-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Sep/1; http://www.securityfocus.com/archive/1/536370/100/0/threaded
CVE: CVE-2015-6929
Published: 2015-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to cftraces/filter/fl_copy.jsp; the (3) flName parameter to cftraces/filter/fl_crea1.jsp; the (4) serchStatus, (5) refreshTime, or (6) serchNode parameter to cftraces/process/pr_show_process.jsp; the (7) MaxActivationTime, (8) NumberOfBytes, (9) NumberOfTracefiles, (10) SessionName, or (11) serchSessionkind parameter to cftraces/session/se_crea.jsp; the (12) serchSessionDescription parameter to cftraces/session/se_show.jsp; the (13) serchApplication or (14) serchApplicationkind parameter to cftraces/session/tr_crea_filter.jsp; the (15) columKeyUnique, (16) columParameter, (17) componentName, (18) criteria1, (19) criteria2, (20) criteria3, (21) description, (22) filter, (23) id, (24) pathName, (25) tableName, or (26) component parameter to cftraces/session/tr_create_tagg_para.jsp; or the (27) userid parameter to home/certificate_association.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133538/Nokia-Solutions-And-Networks-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/42; https://drive.google.com/open?id=0B-LWHbwdK3P9eTNKRkdDWGpkN2M
CVE: CVE-2015-6972
Published: 2015-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group-summary.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt; http://packetstormsecurity.com/files/133558/Openfire-3.10.2-Cross-Site-Scripting.html; https://security.gentoo.org/glsa/201612-50
CVE: CVE-2015-6973
Published: 2015-09-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt; http://packetstormsecurity.com/files/133554/Openfire-3.10.2-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/536470/100/0/threaded
CVE: CVE-2015-6962
Published: 2015-09-17
Description: SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133610/Farol-SQL-Injection.html; https://www.exploit-db.com/exploits/38213/; http://packetstormsecurity.com/files/133610/Farol-SQL-Injection.html
CVE: CVE-2015-1319
Published: 2015-09-17
Description: The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://www.ubuntu.com/usn/USN-2741-1; https://bugs.launchpad.net/ubuntu/%2Bsource/unity/%2Bbug/1438870; http://www.ubuntu.com/usn/USN-2741-1
CVE: CVE-2015-4040
Published: 2015-09-17
Description: Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133931/F5-BigIP-10.2.4-Build-595.0-HF3-Path-Traversal.html; http://www.securitytracker.com/id/1033532; http://www.securitytracker.com/id/1033533
CVE: CVE-2015-5538
Published: 2015-09-17
Description: Multiple unspecified vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allow remote attackers to gain privileges via unknown vectors, related to the (1) Command Line Interface (CLI) and the (2) Web User Interface (UI).
CVSS Score: 10.0 (HIGH)
References: http://support.citrix.com/article/CTX201334; http://www.securitytracker.com/id/1033618; http://support.citrix.com/article/CTX201334
CVE: CVE-2015-6672
Published: 2015-09-17
Description: Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.citrix.com/article/CTX201334; http://www.securitytracker.com/id/1033618; http://support.citrix.com/article/CTX201334
CVE: CVE-2015-7226
Published: 2015-09-17
Description: The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://cgit.drupalcode.org/admin_views/commit/?id=44098bb; http://www.securityfocus.com/bid/75697; https://www.drupal.org/node/2529366