deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3172
Published: 2016-04-12
Description: SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2667; http://lists.opensuse.org/opensuse-updates/2016-05/msg00074.html; http://www.openwall.com/lists/oss-security/2016/03/10/13
CVE: CVE-2016-4003
Published: 2016-04-12
Description: Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://struts.apache.org/docs/s2-028.html; http://www.securityfocus.com/bid/86311; http://www.securitytracker.com/id/1035268
CVE: CVE-2015-5347
Published: 2016-04-12
Description: Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://wicket.apache.org/news/2016/03/01/cve-2015-5347.html; http://www.securitytracker.com/id/1035165; https://issues.apache.org/jira/browse/WICKET-6037
CVE: CVE-2015-7520
Published: 2016-04-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://wicket.apache.org/news/2016/03/02/cve-2015-7520.html; http://www.securitytracker.com/id/1035166; http://wicket.apache.org/news/2016/03/02/cve-2015-7520.html
CVE: CVE-2016-2405
Published: 2016-04-12
Description: Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160217-01-policycenter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160217-01-policycenter-en
CVE: CVE-2016-3654
Published: 2016-04-12
Description: The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://security.paloaltonetworks.com/CVE-2016-3654; https://security.paloaltonetworks.com/CVE-2016-3654
CVE: CVE-2016-3655
Published: 2016-04-12
Description: The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-78
References: https://security.paloaltonetworks.com/CVE-2016-3655; https://security.paloaltonetworks.com/CVE-2016-3655
CVE: CVE-2016-3656
Published: 2016-04-12
Description: The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service (service crash) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://security.paloaltonetworks.com/CVE-2016-3656; https://security.paloaltonetworks.com/CVE-2016-3656
CVE: CVE-2016-3657
Published: 2016-04-12
Description: Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://security.paloaltonetworks.com/CVE-2016-3657; https://security.paloaltonetworks.com/CVE-2016-3657
CVE: CVE-2016-4004
Published: 2016-04-12
Description: Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ (dot dot backslash) in the file parameter to ViewFile.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://www.securitytracker.com/id/1035564; https://www.exploit-db.com/exploits/39486/; http://www.securitytracker.com/id/1035564
CVE: CVE-2016-0088
Published: 2016-04-12
Description: Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035538; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-045; http://www.securitytracker.com/id/1035538
CVE: CVE-2016-0089
Published: 2016-04-12
Description: Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035538; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-045; http://www.securitytracker.com/id/1035538
CVE: CVE-2016-0090
Published: 2016-04-12
Description: Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035538; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-045; http://www.securitytracker.com/id/1035538
CVE: CVE-2016-0122
Published: 2016-04-12
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035525; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-042; https://www.exploit-db.com/exploits/39694/
CVE: CVE-2016-0127
Published: 2016-04-12
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035524; http://www.securitytracker.com/id/1035525; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-042
CVE: CVE-2016-0128
Published: 2016-04-12
Description: The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://www.securitytracker.com/id/1035534; https://bto.bluecoat.com/security-advisory/sa122
CVE: CVE-2016-0135
Published: 2016-04-12
Description: The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035541; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-046; http://www.securitytracker.com/id/1035541
CVE: CVE-2016-0136
Published: 2016-04-12
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035524; http://www.securitytracker.com/id/1035525; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-042
CVE: CVE-2016-0139
Published: 2016-04-12
Description: Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035525; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-042; http://www.securitytracker.com/id/1035525
CVE: CVE-2016-0143
Published: 2016-04-12
Description: The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0165 and CVE-2016-0167.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/85896; http://www.securitytracker.com/id/1035529; http://www.securitytracker.com/id/1035532
CVE: CVE-2016-0145
Published: 2016-04-12
Description: The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035528; http://www.securitytracker.com/id/1035529; http://www.securitytracker.com/id/1035530
CVE: CVE-2016-0147
Published: 2016-04-12
Description: Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035523; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-040; http://www.securitytracker.com/id/1035523
CVE: CVE-2016-0148
Published: 2016-04-12
Description: Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, aka ".NET Framework Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/136671/.NET-Framework-4.6-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2016/Apr/42; http://www.securityfocus.com/archive/1/538063/100/0/threaded
CVE: CVE-2016-0150
Published: 2016-04-12
Description: HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.securitytracker.com/id/1035546; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-049; http://www.securitytracker.com/id/1035546
CVE: CVE-2016-0151
Published: 2016-04-12
Description: The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://www.securitytracker.com/id/1035544; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048; https://www.exploit-db.com/exploits/39740/
CVE: CVE-2016-0153
Published: 2016-04-12
Description: OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035536; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-044; http://www.securitytracker.com/id/1035536
CVE: CVE-2016-0154
Published: 2016-04-12
Description: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035521; http://www.securitytracker.com/id/1035522; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037
CVE: CVE-2016-0155
Published: 2016-04-12
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0156 and CVE-2016-0157.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035522; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038; http://www.securitytracker.com/id/1035522
CVE: CVE-2016-0156
Published: 2016-04-12
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0157.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035522; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038; http://www.securitytracker.com/id/1035522
CVE: CVE-2016-0157
Published: 2016-04-12
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0156.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035522; http://www.zerodayinitiative.com/advisories/ZDI-16-232; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038
CVE: CVE-2016-0158
Published: 2016-04-12
Description: Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securitytracker.com/id/1035522; http://www.zerodayinitiative.com/advisories/ZDI-16-233; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038
CVE: CVE-2016-0159
Published: 2016-04-12
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035521; http://www.zerodayinitiative.com/advisories/ZDI-16-231; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037
CVE: CVE-2016-0160
Published: 2016-04-12
Description: Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/136702/Microsoft-Internet-Explorer-11-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2016/Apr/61; http://www.securityfocus.com/archive/1/538098/100/0/threaded
CVE: CVE-2016-0161
Published: 2016-04-12
Description: Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securitytracker.com/id/1035522; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038; http://www.securitytracker.com/id/1035522
CVE: CVE-2016-0162
Published: 2016-04-12
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/85939; http://www.securitytracker.com/id/1035521; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037
CVE: CVE-2016-0164
Published: 2016-04-12
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/85922; http://www.securitytracker.com/id/1035521; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037
CVE: CVE-2016-0165
Published: 2016-04-12
Description: The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1035529; http://www.securitytracker.com/id/1035532; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039
CVE: CVE-2016-0166
Published: 2016-04-12
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035521; http://www.zerodayinitiative.com/advisories/ZDI-16-230; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037
CVE: CVE-2016-0167
Published: 2016-04-12
Description: The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1035529; http://www.securitytracker.com/id/1035532; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039
CVE: CVE-2016-0887
Published: 2016-04-12
Description: EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html; http://seclists.org/bugtraq/2016/Apr/66; http://www.securityfocus.com/archive/1/538055/100/0/threaded
CVE: CVE-2016-1034
Published: 2016-04-12
Description: The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
References: http://www.zerodayinitiative.com/advisories/ZDI-16-235; https://helpx.adobe.com/security/products/creative-cloud/apsb16-11.html; http://www.zerodayinitiative.com/advisories/ZDI-16-235
CVE: CVE-2016-1035
Published: 2016-04-12
Description: Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035557; https://helpx.adobe.com/security/products/robohelp-server/apsb16-12.html; http://www.securitytracker.com/id/1035557
CVE: CVE-2016-1376
Published: 2016-04-12
Description: Cisco IOS XR 4.2.3, 4.3.0, 4.3.4, and 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (CRC and symbol errors, and interface flap) via crafted bit patterns in packets, aka Bug ID CSCuv78548.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-asr; http://www.securitytracker.com/id/1035560; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-asr
CVE: CVE-2016-1377
Published: 2016-04-12
Description: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCus21776.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-unity; http://www.securitytracker.com/id/1035562; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-unity
CVE: CVE-2016-2001
Published: 2016-04-12
Description: HPE Universal CMDB Foundation 10.0, 10.01, 10.10, 10.11, and 10.20 allows remote attackers to obtain sensitive information or conduct URL redirection attacks via unspecified vectors.
CVSS Score: 7.4 (HIGH)
References: http://www.securitytracker.com/id/1035505; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073504; http://www.securitytracker.com/id/1035505
CVE: CVE-2016-2118
Published: 2016-04-12
Description: The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html