deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5872
Published: 2015-10-09
Description: IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5873, and CVE-2015-5890.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5873
Published: 2015-10-09
Description: IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5890.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5875
Published: 2015-10-09
Description: Cross-site scripting (XSS) vulnerability in Notes in Apple OS X before 10.11 allows local users to inject arbitrary web script or HTML via crafted text.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5877
Published: 2015-10-09
Description: The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5830.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5878
Published: 2015-10-09
Description: Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5881
Published: 2015-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-7760, CVE-2015-7761.  Reason: this ID was intended for one issue, but was associated with two issues.  Notes: All CVE users should consult CVE-2015-7760 and CVE-2015-7761 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-5883
Published: 2015-10-09
Description: The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5884
Published: 2015-10-09
Description: The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during transmission of an S/MIME e-mail message with a large attachment.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5887
Published: 2015-10-09
Description: The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5888
Published: 2015-10-09
Description: The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5889
Published: 2015-10-09
Description: rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://packetstormsecurity.com/files/133826/issetugid-rsh-libmalloc-OS-X-Local-Root.html; http://packetstormsecurity.com/files/134087/Mac-OS-X-10.9.5-10.10.5-rsh-libmalloc-Privilege-Escalation.html
CVE: CVE-2015-5890
Published: 2015-10-09
Description: IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5873.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5891
Published: 2015-10-09
Description: The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5893
Published: 2015-10-09
Description: SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5894
Published: 2015-10-09
Description: The X.509 certificate-trust implementation in Apple OS X before 10.11 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5897
Published: 2015-10-09
Description: The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5900
Published: 2015-10-09
Description: The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value, which allows attackers to cause a denial of service (boot failure) via a crafted app that writes to an unintended address.
CVSS Score: 7.1 (HIGH)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5901
Published: 2015-10-09
Description: The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files, which might allow local users to obtain sensitive information by reading storage media, as demonstrated by reading a flash drive.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5902
Published: 2015-10-09
Description: The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5913
Published: 2015-10-09
Description: Heimdal, as used in Apple OS X before 10.11, allows remote attackers to conduct replay attacks against the SMB server via packet data that represents a Kerberos authenticated request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5914
Published: 2015-10-09
Description: The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inserting an Apple Ethernet Thunderbolt adapter with crafted code in an Option ROM, aka a "Thunderstrike" issue.  NOTE: this issue exists because of an incomplete fix for CVE-2014-4498.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5915
Published: 2015-10-09
Description: Apple OS X before 10.11 does not ensure that the keychain's lock state is displayed correctly, which has unspecified impact and attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5917
Published: 2015-10-09
Description: The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5918
Published: 2015-10-09
Description: GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5919.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://www.securitytracker.com/id/1033620; https://support.apple.com/HT205213
CVE: CVE-2015-5919
Published: 2015-10-09
Description: GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5918.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://www.securitytracker.com/id/1033620; https://support.apple.com/HT205213
CVE: CVE-2015-5922
Published: 2015-10-09
Description: Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76911
CVE: CVE-2015-5923
Published: 2015-10-09
Description: Apple iOS before 9.0.2 does not properly restrict the options available on the lock screen, which allows physically proximate attackers to read contact data or view photos via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00006.html; http://www.securitytracker.com/id/1033687; https://support.apple.com/HT205284
CVE: CVE-2015-7760
Published: 2015-10-09
Description: libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections, which allows remote attackers to cause a denial of service (resource consumption) by repeatedly connecting to the SSH port, a different vulnerability than CVE-2015-7761.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-7761
Published: 2015-10-09
Description: Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; https://support.apple.com/HT205267
CVE: CVE-2015-1337
Published: 2015-10-09
Description: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.ubuntu.com/usn/USN-2746-1; http://www.ubuntu.com/usn/USN-2746-2; https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004
CVE: CVE-2015-5234
Published: 2015-10-09
Description: IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html
CVE: CVE-2015-5235
Published: 2015-10-09
Description: IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167120.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167130.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00019.html
CVE: CVE-2015-7765
Published: 2015-10-09
Description: ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
CVSS Score: 9.0 (HIGH)
References: http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2015/Sep/66; http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce
CVE: CVE-2015-7766
Published: 2015-10-09
Description: PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2015/Sep/66; http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce
CVE: CVE-2015-7767
Published: 2015-10-09
Description: Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long USER command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/37908/; https://www.exploit-db.com/exploits/38252/; https://www.exploit-db.com/exploits/37908/
CVE: CVE-2015-7768
Published: 2015-10-09
Description: Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133621/Konica-Minolta-FTP-Utility-1.00-Post-Auth-CWD-Command-SEH-Overflow.html; http://packetstormsecurity.com/files/137252/Konica-Minolta-FTP-Utility-1.0-SEH-Buffer-Overflow.html; http://www.rapid7.com/db/modules/exploit/windows/ftp/kmftp_utility_cwd
CVE: CVE-2015-4929
Published: 2015-10-11
Description: IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21966169; http://www.securitytracker.com/id/1033758; http://www-01.ibm.com/support/docview.wss?uid=swg21966169
CVE: CVE-2015-5648
Published: 2015-10-11
Description: SQL injection vulnerability in list.php in phpRechnung before 1.6.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN02671769/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000154; http://sourceforge.net/projects/phprechnung/files/phpRechnung/1.6.5/phpRechnung_1_6_5.tar.bz2/download
CVE: CVE-2015-5654
Published: 2015-10-11
Description: Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN13456571/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000153; http://www-01.ibm.com/support/docview.wss?uid=swg21975256
CVE: CVE-2015-5659
Published: 2015-10-11
Description: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN84982142/995760/index.html; http://jvn.jp/en/jp/JVN84982142/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000158
CVE: CVE-2015-1303
Published: 2015-10-12
Description: bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00002.html
CVE: CVE-2015-1304
Published: 2015-10-12
Description: object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00002.html
CVE: CVE-2015-4547
Published: 2015-10-12
Description: EMC RSA Web Threat Detection before 5.1 SP1 stores a cleartext AnnoDB password in a configuration file, which allows remote authenticated users to obtain sensitive information by reading this file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/133779/RSA-Web-Threat-Detection-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/bugtraq/2015/Sep/134; http://www.securitytracker.com/id/1033672
CVE: CVE-2015-4548
Published: 2015-10-12
Description: EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/133779/RSA-Web-Threat-Detection-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/bugtraq/2015/Sep/134; http://www.securitytracker.com/id/1033672
CVE: CVE-2015-6263
Published: 2015-10-12
Description: The RADIUS client implementation in Cisco IOS 15.4(3)M2.2, when a shared RADIUS secret is configured, allows remote RADIUS servers to cause a denial of service (device reload) via malformed answers, aka Bug ID CSCuu59324.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151005-ios-radius; http://www.securitytracker.com/id/1033747; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151005-ios-radius
CVE: CVE-2015-1047
Published: 2015-10-12
Description: vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/76932; http://www.securitytracker.com/id/1033720; http://www.vmware.com/security/advisories/VMSA-2015-0007.html
CVE: CVE-2015-2342
Published: 2015-10-12
Description: The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/fulldisclosure/2015/Oct/1; http://www.securityfocus.com/bid/76930; http://www.securitytracker.com/id/1033720
CVE: CVE-2015-4265
Published: 2015-10-12
Description: Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets over the Inter-IC (I2C) bus, aka Bug ID CSCuq77241.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151006-ucs; http://www.securitytracker.com/id/1033752; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151006-ucs
CVE: CVE-2015-4325
Published: 2015-10-12
Description: The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151006-vcs; http://www.securitytracker.com/id/1033751; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151006-vcs