deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6158
Published: 2015-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6159
Published: 2015-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6160
Published: 2015-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2013-6161
Published: 2015-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013.  Notes: none
CVE: CVE-2015-0678
Published: 2015-04-11
Description: The virtualization layer in Cisco ASA FirePOWER Software before 5.3.1.2 and 5.4.x before 5.4.0.1 and ASA Context-Aware (CX) Software before 9.3.2.1-9 allows remote attackers to cause a denial of service (device reload) by rapidly sending crafted packets to the management interface, aka Bug IDs CSCus11007 and CSCun56954.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-cxfp; http://www.securitytracker.com/id/1032046; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-cxfp
CVE: CVE-2015-0692
Published: 2015-04-11
Description: Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38305; http://www.securitytracker.com/id/1032097; http://tools.cisco.com/security/center/viewAlert.x?alertId=38305
CVE: CVE-2015-0694
Published: 2015-04-11
Description: Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38292; http://www.securitytracker.com/id/1032059; http://tools.cisco.com/security/center/viewAlert.x?alertId=38292
CVE: CVE-2015-0675
Published: 2015-04-13
Description: The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa; http://www.securitytracker.com/id/1032045; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
CVE: CVE-2015-0676
Published: 2015-04-13
Description: The DNS implementation in Cisco Adaptive Security Appliance (ASA) Software 7.2 before 7.2(5.16), 8.2 before 8.2(5.57), 8.3 before 8.3(2.44), 8.4 before 8.4(7.28), 8.5 before 8.5(1.24), 8.6 before 8.6(1.17), 8.7 before 8.7(1.16), 9.0 before 9.0(4.33), 9.1 before 9.1(6.1), 9.2 before 9.2(3.4), and 9.3 before 9.3(3) allows man-in-the-middle attackers to cause a denial of service (memory consumption or device outage) by triggering outbound DNS queries and then sending crafted responses to these queries, aka Bug ID CSCuq77655.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa; http://www.securitytracker.com/id/1032045; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
CVE: CVE-2015-0677
Published: 2015-04-13
Description: The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28), 8.6 before 8.6(1.17), 9.0 before 9.0(4.33), 9.1 before 9.1(6), 9.2 before 9.2(3.4), and 9.3 before 9.3(3), when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document, aka Bug ID CSCus95290.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa; http://www.securitytracker.com/id/1032045; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
CVE: CVE-2014-9714
Published: 2015-04-13
Description: Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3; http://www.securityfocus.com/bid/74061
CVE: CVE-2015-0840
Published: 2015-04-13
Description: The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00029.html; http://www.debian.org/security/2015/dsa-3217
CVE: CVE-2015-2775
Published: 2015-04-13
Description: Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154911.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156742.html; http://rhn.redhat.com/errata/RHSA-2015-1153.html
CVE: CVE-2015-2846
Published: 2015-04-13
Description: BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.
CVSS Score: 9.3 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/73906; http://www.zerodayinitiative.com/advisories/ZDI-15-115/; http://www.securityfocus.com/bid/73906
CVE: CVE-2015-2931
Published: 2015-04-13
Description: Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2932
Published: 2015-04-13
Description: Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2933
Published: 2015-04-13
Description: Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2934
Published: 2015-04-13
Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2935
Published: 2015-04-13
Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2936
Published: 2015-04-13
Description: MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2937
Published: 2015-04-13
Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2938
Published: 2015-04-13
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2939
Published: 2015-04-13
Description: Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2940
Published: 2015-04-13
Description: Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:200; http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3
CVE: CVE-2015-2941
Published: 2015-04-13
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3; http://www.securityfocus.com/bid/73477
CVE: CVE-2015-2942
Published: 2015-04-13
Description: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2015/04/01/1; http://www.openwall.com/lists/oss-security/2015/04/07/3; http://www.securityfocus.com/bid/73477
CVE: CVE-2014-9145
Published: 2015-04-14
Description: Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter to dapur/apps/app_article/controller/article_list.php; or (5) email parameter in an email action or (6) username parameter in a user action to dapur/apps/app_user/controller/check_user.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html; http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
CVE: CVE-2014-9146
Published: 2015-04-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html; http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
CVE: CVE-2014-9311
Published: 2015-04-14
Description: Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131321/WordPress-Shareaholic-7.6.0.3-Cross-Site-Scripting.html; http://security.szurek.pl/shareaholic-7603-xss.html; https://wordpress.org/plugins/shareaholic/changelog/
CVE: CVE-2015-2223
Published: 2015-04-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535113/100/0/threaded; http://www.securityfocus.com/bid/73704
CVE: CVE-2015-2781
Published: 2015-04-14
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Apr/18; http://www.securityfocus.com/archive/1/535186/100/0/threaded
CVE: CVE-2015-2926
Published: 2015-04-14
Description: Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131332/phpTrafficA-2.3-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535212/100/0/threaded; http://www.securityfocus.com/bid/74046
CVE: CVE-2014-5032
Published: 2015-04-14
Description: GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2015-0017.html; http://www.glpi-project.org/spip.php?page=annonce&id_breve=325; http://www.mandriva.com/security/advisories?name=MDVSA-2015:167
CVE: CVE-2014-8360
Published: 2015-04-14
Description: Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://advisories.mageia.org/MGASA-2015-0017.html; http://tlk.tuxfamily.org/doku.php?id=writeup:cve-2014-8360-en; http://www.glpi-project.org/spip.php?page=annonce&id_breve=330
CVE: CVE-2014-9488
Published: 2015-04-14
Description: The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0139.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159449.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00077.html
CVE: CVE-2015-0844
Published: 2015-04-14
Description: The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://forums.wesnoth.org/viewtopic.php?t=41870; http://forums.wesnoth.org/viewtopic.php?t=41872; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155031.html
CVE: CVE-2015-2788
Published: 2015-04-14
Description: Multiple stack-based buffer overflows in the ib_fill_isqlda function in dbdimp.c in DBD-Firebird before 1.19 allow remote attackers to have unspecified impact via unknown vectors that trigger an error condition, related to binding octets to columns.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3219; http://www.openwall.com/lists/oss-security/2015/03/30/10; http://www.openwall.com/lists/oss-security/2015/03/30/4
CVE: CVE-2015-2831
Published: 2015-04-14
Description: Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3221; http://www.openwall.com/lists/oss-security/2015/04/01/8; http://www.openwall.com/lists/oss-security/2015/04/02/13
CVE: CVE-2015-3293
Published: 2015-04-14
Description: FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.fortiguard.com/advisory/FG-IR-15-009/; http://www.securitytracker.com/id/1032185; http://www.fortiguard.com/advisory/FG-IR-15-009/
CVE: CVE-2015-0098
Published: 2015-04-14
Description: Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Scheduler Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1032112; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-037; http://www.securitytracker.com/id/1032112
CVE: CVE-2015-1635
Published: 2015-04-14
Description: HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html; http://www.osvdb.org/120629; http://www.securityfocus.com/bid/74013
CVE: CVE-2015-1638
Published: 2015-04-14
Description: Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.securitytracker.com/id/1032115; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-040; http://www.securitytracker.com/id/1032115
CVE: CVE-2015-1639
Published: 2015-04-14
Description: Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Outlook App for Mac XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1032104; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033; http://www.securitytracker.com/id/1032104
CVE: CVE-2015-1640
Published: 2015-04-14
Description: Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1032111; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-036; http://www.securitytracker.com/id/1032111
CVE: CVE-2015-1641
Published: 2015-04-14
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/73995; http://www.securitytracker.com/id/1032104; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033
CVE: CVE-2015-1643
Published: 2015-04-14
Description: Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "NtCreateTransactionManager Type Confusion Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1032113; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-038; http://www.securitytracker.com/id/1032113