deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14712
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://www.exploit-db.com/exploits/42950/; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14713
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14714
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14715
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14716
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14717
Published: 2017-09-22
Description: In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830; https://www.exploit-db.com/exploits/42950/; https://forum.epesibim.com/d/4956-security-issue-multiple-stored-xss-in-epesi-version-1-8-2-rev20170830
CVE: CVE-2017-14627
Published: 2017-09-23
Description: Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blog.spentera.com/2017/09/19/unicode-stack-based-buffer-overflow-on-cyberlink-labelprint-2-5/; https://www.exploit-db.com/exploits/42777/; https://www.exploit-db.com/exploits/45985/
CVE: CVE-2017-14718
Published: 2017-09-23
Description: Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41393
CVE: CVE-2017-14719
Published: 2017-09-23
Description: Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41457
CVE: CVE-2017-14720
Published: 2017-09-23
Description: Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41412
CVE: CVE-2017-14721
Published: 2017-09-23
Description: Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41412
CVE: CVE-2017-14722
Published: 2017-09-23
Description: Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41397
CVE: CVE-2017-14723
Published: 2017-09-23
Description: Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41470
CVE: CVE-2017-14724
Published: 2017-09-23
Description: Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41448
CVE: CVE-2017-14725
Published: 2017-09-23
Description: Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41398
CVE: CVE-2017-14726
Published: 2017-09-23
Description: Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100912; http://www.securitytracker.com/id/1039553; https://core.trac.wordpress.org/changeset/41395
CVE: CVE-2017-14727
Published: 2017-09-23
Description: logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101003; https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556; https://weechat.org/download/security/
CVE: CVE-2017-14506
Published: 2017-09-25
Description: geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html; https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md; http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
CVE: CVE-2017-14683
Published: 2017-09-25
Description: geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html; https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md; http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
CVE: CVE-2017-1235
Published: 2017-09-25
Description: IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potentially cause denial of service. IBM X-Force ID: 123914.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22005415; http://www.securityfocus.com/bid/100955; https://exchange.xforce.ibmcloud.com/vulnerabilities/123914
CVE: CVE-2017-1346
Published: 2017-09-25
Description: IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461.
CVSS Score: 2.5 (LOW)
CWE: CWE-200, CWE-362
References: http://www.ibm.com/support/docview.wss?uid=swg22004654; http://www.securityfocus.com/bid/100964; https://exchange.xforce.ibmcloud.com/vulnerabilities/126461
CVE: CVE-2017-1362
Published: 2017-09-25
Description: IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22007381; http://www.securityfocus.com/bid/100965; https://exchange.xforce.ibmcloud.com/vulnerabilities/126801
CVE: CVE-2017-1424
Published: 2017-09-25
Description: IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127477.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005112; http://www.securityfocus.com/bid/100962; https://exchange.xforce.ibmcloud.com/vulnerabilities/127477
CVE: CVE-2017-14729
Published: 2017-09-25
Description: The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22170; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=56933f9e3e90eebf1018ed7417d6c1184b91db6b
CVE: CVE-2017-1551
Published: 2017-09-25
Description: IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 131291.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22008372; https://exchange.xforce.ibmcloud.com/vulnerabilities/131291; http://www.ibm.com/support/docview.wss?uid=swg22008372
CVE: CVE-2017-1555
Published: 2017-09-25
Description: IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22008588; http://www.securityfocus.com/bid/100973; https://exchange.xforce.ibmcloud.com/vulnerabilities/131545
CVE: CVE-2017-9551
Published: 2017-09-25
Description: Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the user and administrator and if accepted become part of the new user's account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mahara/+bug/1697308; https://mahara.org/interaction/forum/topic.php?id=8040; https://bugs.launchpad.net/mahara/+bug/1697308
CVE: CVE-2010-3049
Published: 2017-09-25
Description: Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html; https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html
CVE: CVE-2010-3050
Published: 2017-09-25
Description: Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html; https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html
CVE: CVE-2015-4667
Published: 2017-09-25
Description: Multiple hardcoded credentials in Xsuite 2.x.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt; http://www.securityfocus.com/archive/1/536058/100/0/threaded; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2015-4668
Published: 2017-09-25
Description: Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt; http://www.securityfocus.com/archive/1/536058/100/0/threaded; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2015-4669
Published: 2017-09-25
Description: The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt; http://www.securityfocus.com/archive/1/536058/100/0/threaded; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2015-5237
Published: 2017-09-25
Description: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2015/08/27/2; https://bugzilla.redhat.com/show_bug.cgi?id=1256426; https://github.com/google/protobuf/issues/760
CVE: CVE-2015-5282
Published: 2017-09-25
Description: Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/11859; http://www.openwall.com/lists/oss-security/2015/09/21/3; https://bugzilla.redhat.com/show_bug.cgi?id=1264221
CVE: CVE-2015-6748
Published: 2017-09-25
Description: Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/08/28/5; http://www.securityfocus.com/bid/76504; https://bugzilla.redhat.com/show_bug.cgi?id=1258310
CVE: CVE-2015-7315
Published: 2017-09-25
Description: Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/09/22/13; https://bugzilla.redhat.com/show_bug.cgi?id=1264791; https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406
CVE: CVE-2015-7316
Published: 2017-09-25
Description: Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/09/22/14; https://bugzilla.redhat.com/show_bug.cgi?id=1264788; https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087
CVE: CVE-2015-7317
Published: 2017-09-25
Description: Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/09/22/15; https://bugzilla.redhat.com/show_bug.cgi?id=1264799; https://plone.org/security/hotfix/20150910
CVE: CVE-2015-7318
Published: 2017-09-25
Description: Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/09/22/16; https://bugzilla.redhat.com/show_bug.cgi?id=1264796; https://plone.org/security/hotfix/20150910
CVE: CVE-2017-12905
Published: 2017-09-25
Description: Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: http://seclists.org/fulldisclosure/2017/Sep/47; http://seclists.org/fulldisclosure/2017/Sep/47
CVE: CVE-2017-14125
Published: 2017-09-25
Description: SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Sep/55; https://wpvulndb.com/vulnerabilities/8907; http://seclists.org/fulldisclosure/2017/Sep/55
CVE: CVE-2017-14730
Published: 2017-09-25
Description: The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://bugs.gentoo.org/628558; https://github.com/gentoo/gentoo/pull/5665; https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79fa
CVE: CVE-2011-4667
Published: 2017-09-25
Description: The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6), and Cisco IOS in Cisco VPN Services Port Adaptor for Catalyst 6500 12.2(33)SXI, and 12.2(33)SXJ when IP Security (aka IPSec) is used, allows remote attackers to obtain unencrypted packets from encrypted sessions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20120913-CVE-2011-4667; https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/release/notes/ol_14271/caveats_SXI_rebuilds.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20120913-CVE-2011-4667
CVE: CVE-2012-6696
Published: 2017-09-25
Description: inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3226; http://www.openwall.com/lists/oss-security/2015/08/26/1; https://github.com/inspircd/inspircd/commit/ed28c1ba666b39581adb860bf51cdde43c84cc89
CVE: CVE-2015-5169
Published: 2017-09-25
Description: Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN95989300/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.html; http://www.securityfocus.com/bid/76625
CVE: CVE-2015-5181
Published: 2017-09-25
Description: The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2015-2556.html; https://bugzilla.redhat.com/show_bug.cgi?id=1248804; https://rhn.redhat.com/errata/RHSA-2015-2557.html
CVE: CVE-2015-5182
Published: 2017-09-25
Description: Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1248809; https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E; https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E
CVE: CVE-2015-5183
Published: 2017-09-25
Description: Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1041750; https://access.redhat.com/errata/RHSA-2018:2840; https://bugzilla.redhat.com/show_bug.cgi?id=1249182
CVE: CVE-2015-5184
Published: 2017-09-25
Description: Console: CORS headers set to allow all in Red Hat AMQ.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.redhat.com/show_bug.cgi?id=1249183; https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E; https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E
CVE: CVE-2015-5263
Published: 2017-09-25
Description: pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://cve.killedkenny.io/cve/CVE-2015-5263; http://www.openwall.com/lists/oss-security/2015/09/24/4; https://github.com/pulp/pulp/blob/aa432bf58497b5e3682333b1d5f5ae4f45788a61/client_consumer/pulp/client/consumer/cli.py#L103
CVE: CVE-2015-5327
Published: 2017-09-25
Description: Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2015/11/27/1; https://bugzilla.redhat.com/show_bug.cgi?id=1278978; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc25b994acfbc901429da682d0f73c190e960206
CVE: CVE-2015-5666
Published: 2017-09-25
Description: ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN25086409/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000164.html; http://www.securityfocus.com/bid/77344
CVE: CVE-2015-5704
Published: 2017-09-25
Description: scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163710.html; http://www.openwall.com/lists/oss-security/2015/08/01/7
CVE: CVE-2015-6592
Published: 2017-09-25
Description: Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/76552; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-452865.htm; http://www.securityfocus.com/bid/76552
CVE: CVE-2015-7293
Published: 2017-09-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html; https://plone.org/security/hotfix/20151006; https://pypi.python.org/pypi/plone4.csrffixes