deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5784
Published: 2015-08-17
Description: runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://www.securityfocus.com/bid/76340; http://www.securitytracker.com/id/1033276
CVE: CVE-2014-9743
Published: 2015-08-17
Description: Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=fe5063ec5ad1873039ea719eb1f137c8f3bda84b; http://seclists.org/fulldisclosure/2014/Mar/324; http://www.quantumleap.it/vlc-reflected-xss-vulnerability/
CVE: CVE-2015-5531
Published: 2015-08-17
Description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html; http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html; http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html
CVE: CVE-2015-0277
Published: 2015-08-17
Description: The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion.  NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2015-0846.html; http://rhn.redhat.com/errata/RHSA-2015-0847.html; http://rhn.redhat.com/errata/RHSA-2015-0848.html
CVE: CVE-2015-6254
Published: 2015-08-17
Description: The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors.  NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-17
References: http://rhn.redhat.com/errata/RHSA-2015-0846.html; http://rhn.redhat.com/errata/RHSA-2015-0847.html; http://rhn.redhat.com/errata/RHSA-2015-0848.html
CVE: CVE-2015-4029
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jul/66; https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc; http://seclists.org/fulldisclosure/2015/Jul/66
CVE: CVE-2015-5485
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132676/The-Events-Calender-Eventbrite-Tickets-3.9.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jul/67; https://security.dxw.com/advisories/reflected-xss-in-the-events-calendar-eventbrite-tickets-allows-unauthenticated-users-to-do-almost-anything-an-admin-can/
CVE: CVE-2015-5599
Published: 2015-08-18
Description: Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/64; http://www.openwall.com/lists/oss-security/2015/07/20/1
CVE: CVE-2015-5681
Published: 2015-08-18
Description: Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/64; http://www.openwall.com/lists/oss-security/2015/07/20/1
CVE: CVE-2015-6508
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the descr parameter in a "new" action to system_authservers.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://redmine.pfsense.org/issues/4698; https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc; https://redmine.pfsense.org/issues/4698
CVE: CVE-2015-6509
Published: 2015-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc; https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc
CVE: CVE-2015-6510
Published: 2015-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3) use_mfs_var_size parameter to system_advanced_misc.php; the (4) port, (5) snaplen, or (6) count parameter to diag_packet_capture.php; the (7) pppoe_resethour, (8) pppoe_resetminute, (9) wpa_group_rekey, or (10) wpa_gmk_rekey parameter to interfaces.php; the (11) pppoe_resethour or (12) pppoe_resetminute parameter to interfaces_ppps_edit.php; the (13) member[] parameter to interfaces_qinq_edit.php; the (14) port or (15) retry parameter to load_balancer_pool_edit.php; the (16) pkgrepourl parameter to pkg_mgr_settings.php; the (17) zone parameter to services_captiveportal.php; the port parameter to (18) services_dnsmasq.php or (19) services_unbound.php; the (20) cache_max_ttl or (21) cache_min_ttl parameter to services_unbound_advanced.php; the (22) sshport parameter to system_advanced_admin.php; the (23) id, (24) tunable, (25) descr, or (26) value parameter to system_advanced_sysctl.php; the (27) firmwareurl, (28) repositoryurl, or (29) branch parameter to system_firmware_settings.php; the (30) pfsyncpeerip, (31) synchronizetoip, (32) username, or (33) passwordfld parameter to system_hasync.php; the (34) maxmss parameter to vpn_ipsec_settings.php; the (35) ntp_server1, (36) ntp_server2, (37) wins_server1, or (38) wins_server2 parameter to vpn_openvpn_csc.php; or unspecified parameters to (39) load_balancer_relay_action.php, (40) load_balancer_relay_action_edit.php, (41) load_balancer_relay_protocol.php, or (42) load_balancer_relay_protocol_edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc; https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc
CVE: CVE-2015-6511
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc; https://www.pfsense.org/security/advisories/pfSense-SA-15_06.webgui.asc
CVE: CVE-2015-6512
Published: 2015-08-18
Description: SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132673/FreiChat-9.6-SQL-Injection.html; http://security.szurek.pl/freichat-96-sql-injection.html; https://www.exploit-db.com/exploits/37592/
CVE: CVE-2015-6513
Published: 2015-08-18
Description: Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://j2store.org/download-j2store/j2store-v3-3-1-7.html; http://packetstormsecurity.com/files/132658/Joomla-J2Store-3.1.6-SQL-Injection.html; http://volatileminds.net/2015/07/07/j2store-316-sql-injection.html
CVE: CVE-2015-6514
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1032859; http://www.splunk.com/view/SP-CAAAN7C; http://www.securitytracker.com/id/1032859
CVE: CVE-2015-6515
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1032859; http://www.splunk.com/view/SP-CAAAN7C; http://www.securitytracker.com/id/1032859
CVE: CVE-2015-6516
Published: 2015-08-18
Description: SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132672/sysPass-1.0.9-SQL-Injection.html; http://www.securityfocus.com/archive/1/535989/100/0/threaded; https://www.exploit-db.com/exploits/37610/
CVE: CVE-2015-4425
Published: 2015-08-18
Description: Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2015/Jul/57; https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/
CVE: CVE-2015-4426
Published: 2015-08-18
Description: SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2015/Jul/58; http://www.securityfocus.com/bid/75724; https://github.com/pimcore/pimcore/commit/1c6692e8287deed7f3356b6a1e2e9b7fe4e858dd
CVE: CVE-2015-4670
Published: 2015-08-18
Description: Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.cardinaleconcepts.com/cve-2015-4670-directory-traversal-to-remote-code-execution-in-ajaxcontroltoolkit/; http://www.securityfocus.com/archive/1/535990/100/0/threaded; http://www.cardinaleconcepts.com/cve-2015-4670-directory-traversal-to-remote-code-execution-in-ajaxcontroltoolkit/
CVE: CVE-2015-5481
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132657/WordPress-GD-bbPress-Attachments-2.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jul/53; https://security.dxw.com/advisories/reflected-xss-in-gd-bbpress-attachments-allows-an-attacker-to-do-almost-anything-an-admin-can/
CVE: CVE-2015-5482
Published: 2015-08-18
Description: Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txt; https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/; https://wordpress.org/plugins/gd-bbpress-attachments/changelog/
CVE: CVE-2015-5487
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access tab.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74465; https://www.drupal.org/node/2480169
CVE: CVE-2015-5488
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "administer mailchimp" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2480173; https://www.drupal.org/node/2480253
CVE: CVE-2015-5489
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2480289; https://www.drupal.org/node/2480321
CVE: CVE-2015-5490
Published: 2015-08-18
Description: The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://cgit.drupalcode.org/views/commit/?id=cef693b; http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74462
CVE: CVE-2015-5491
Published: 2015-08-18
Description: The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access restrictions and read sensitive titles by leveraging the "administer ddblock" permission.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2484157; https://www.drupal.org/node/2504965
CVE: CVE-2015-5492
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2484195; http://www.openwall.com/lists/oss-security/2015/07/04/4
CVE: CVE-2015-5493
Published: 2015-08-18
Description: The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which allows remote attackers to obtain access to certain entityforms via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2483687; https://www.drupal.org/node/2484169
CVE: CVE-2015-5494
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2442741; https://www.drupal.org/node/2484231
CVE: CVE-2015-5495
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Mobile sliding menu module 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer menu" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2484213; https://www.drupal.org/node/2484233
CVE: CVE-2015-5496
Published: 2015-08-18
Description: The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74755; https://www.drupal.org/node/2492205
CVE: CVE-2015-5497
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2487542; https://www.drupal.org/node/2487548
CVE: CVE-2015-5498
Published: 2015-08-18
Description: The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74757; https://www.drupal.org/node/2487580
CVE: CVE-2015-5499
Published: 2015-08-18
Description: The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2492245; http://www.openwall.com/lists/oss-security/2015/07/04/4
CVE: CVE-2015-5500
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; https://www.drupal.org/node/2492245; http://www.openwall.com/lists/oss-security/2015/07/04/4
CVE: CVE-2015-5501
Published: 2015-08-18
Description: The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://community.aegirproject.org/2.4; http://community.aegirproject.org/3.0-beta2; http://www.openwall.com/lists/oss-security/2015/07/04/4
CVE: CVE-2015-5502
Published: 2015-08-18
Description: The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74867; https://www.drupal.org/node/2495895
CVE: CVE-2015-5503
Published: 2015-08-18
Description: Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/74871; https://www.drupal.org/node/2495929
CVE: CVE-2015-5504
Published: 2015-08-18
Description: SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75039; http://www.securityfocus.com/bid/75040
CVE: CVE-2015-5505
Published: 2015-08-18
Description: The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75276; http://www.securitytracker.com/id/1037633
CVE: CVE-2015-5506
Published: 2015-08-18
Description: The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote attackers to obtain information about unpublished content via a search.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75275; https://www.drupal.org/node/2489890
CVE: CVE-2015-5507
Published: 2015-08-18
Description: Cross-site scripting (XSS) vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/04/4; http://www.securityfocus.com/bid/75283; https://www.drupal.org/node/2507593