deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7729
Published: 2015-10-15
Description: Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00[PII_REDACTED] allows remote authenticated users to execute arbitrary XSJS code via unspecified vectors, aka SAP Security Note 2153892.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/133763/SAP-HANA-test-net.xsjs-Code-Injection.html; http://seclists.org/fulldisclosure/2015/Sep/112; https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition
CVE: CVE-2015-7730
Published: 2015-10-15
Description: SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet, aka SAP Security Note 2001108.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2015/Sep/81; http://www.securitytracker.com/id/1033637; https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition
CVE: CVE-2015-7838
Published: 2015-10-15
Description: ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.solarwinds.com/documentation/srm/docs/releasenotes/releasenotes.htm; http://www.zerodayinitiative.com/advisories/ZDI-15-460; http://www.solarwinds.com/documentation/srm/docs/releasenotes/releasenotes.htm
CVE: CVE-2015-7839
Published: 2015-10-15
Description: SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://www.zerodayinitiative.com/advisories/ZDI-15-461; http://www.zerodayinitiative.com/advisories/ZDI-15-461
CVE: CVE-2015-7840
Published: 2015-10-15
Description: The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm; https://security.gentoo.org/glsa/201603-11; http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm
CVE: CVE-2013-7445
Published: 2015-10-16
Description: The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: https://bugzilla.kernel.org/show_bug.cgi?id=60533; https://bugzilla.kernel.org/show_bug.cgi?id=60533
CVE: CVE-2015-4948
Published: 2015-10-16
Description: netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/netstat_advisory.asc; http://www-01.ibm.com/support/docview.wss?uid=swg1IV75940; http://www-01.ibm.com/support/docview.wss?uid=swg1IV77299
CVE: CVE-2015-5660
Published: 2015-10-16
Description: Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://extplorer.net/news/18; http://jvn.jp/en/jp/JVN92520335/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000126
CVE: CVE-2015-6003
Published: 2015-10-16
Description: Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/751328; http://www.securitytracker.com/id/1033794; https://www.qnap.com/i/en/support/con_show.php?cid=85
CVE: CVE-2015-6333
Published: 2015-10-16
Description: Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151012-apic; http://www.securitytracker.com/id/1033793; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151012-apic
CVE: CVE-2015-6334
Published: 2015-10-16
Description: Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet, aka Bug ID CSCuw01984.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151012-asr; http://www.securitytracker.com/id/1033792; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151012-asr
CVE: CVE-2014-6449
Published: 2015-10-16
Description: Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R7, 14.1 before 14.1R5, and 14.2 before 14.2R1 do not properly handle TCP packet reassembly, which allows remote attackers to cause a denial of service (buffer consumption) via a crafted sequence of packets "destined to the device."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10696; http://www.securitytracker.com/id/1033853; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10696
CVE: CVE-2014-6450
Published: 2015-10-16
Description: Juniper Junos OS before 11.4R12-S4, 12.1X44 before 12.1X44-D41, 12.1X46 before 12.1X46-D26, 12.1X47 before 12.1X47-D11/D15, 12.2 before 12.2R9, 12.2X50 before 12.2X50-D70, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 12.3X50 before 12.3X50-D42, 13.1 before 13.1R4-S3, 13.1X49 before 13.1X49-D42, 13.1X50 before 13.1X50-D30, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D26, 13.2X52 before 13.2X52-D15, 13.3 before 13.3R3-S3, 14.1 before 14.1R3, 14.2 before 14.2R1, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10, when configured for IPv6, allow remote attackers to cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10699; http://www.securitytracker.com/id/1033855; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10699
CVE: CVE-2014-6451
Published: 2015-10-16
Description: J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10700; http://www.securitytracker.com/id/1033857; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10700
CVE: CVE-2015-1806
Published: 2015-10-16
Description: The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205620
CVE: CVE-2015-1807
Published: 2015-10-16
Description: Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205622
CVE: CVE-2015-1808
Published: 2015-10-16
Description: Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205623
CVE: CVE-2015-1810
Published: 2015-10-16
Description: The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205627
CVE: CVE-2015-1812
Published: 2015-10-16
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205615
CVE: CVE-2015-1813
Published: 2015-10-16
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205615
CVE: CVE-2015-1814
Published: 2015-10-16
Description: The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1844.html; https://access.redhat.com/errata/RHSA-2016:0070; https://bugzilla.redhat.com/show_bug.cgi?id=1205616
CVE: CVE-2015-5742
Published: 2015-10-16
Description: VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/133906/Veeam-Backup-And-Replication-6-7-8-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Oct/44; http://www.securityfocus.com/archive/1/536647/100/0/threaded
CVE: CVE-2015-7377
Published: 2015-10-16
Description: Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133928/WordPress-Pie-Register-2.0.18-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536668/100/0/threaded; https://github.com/GTSolutions/Pie-Register/blob/2.0.19/readme.txt
CVE: CVE-2015-7682
Published: 2015-10-16
Description: Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133929/WordPress-Pie-Register-2.0.18-SQL-Injection.html; http://www.securityfocus.com/archive/1/536669/100/0/threaded; https://github.com/GTSolutions/Pie-Register/blob/2.0.19/readme.txt
CVE: CVE-2015-7683
Published: 2015-10-16
Description: Absolute path traversal vulnerability in Font.php in the Font plugin before 7.5.1 for WordPress allows remote administrators to read arbitrary files via a full pathname in the url parameter to AjaxProxy.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133930/WordPress-Font-7.5-Path-Traversal.html; http://www.securityfocus.com/archive/1/536670/100/0/threaded; https://wordpress.org/plugins/font/changelog/
CVE: CVE-2015-7856
Published: 2015-10-16
Description: OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.opennms.org/wiki/CVE-2015-0975; http://www.rapid7.com/db/modules/auxiliary/gather/opennms_xxe; http://www.opennms.org/wiki/CVE-2015-0975
CVE: CVE-2015-5444
Published: 2015-10-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP Smart Profile Server Data Analytics Layer (SPS DAL) 2.3 before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04845334; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04845334
CVE: CVE-2015-5662
Published: 2015-10-18
Description: Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN25576608/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000160; http://www.securitytracker.com/id/1033860
CVE: CVE-2015-7184
Published: 2015-10-18
Description: The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.html; http://www.mozilla.org/security/announce/2015/mfsa2015-115.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7635
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7636
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7637
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7638
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7639
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7640
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7641
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7642
Published: 2015-10-18
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1893.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77061
CVE: CVE-2015-7647
Published: 2015-10-18
Description: Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7648.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1913.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77115
CVE: CVE-2015-7648
Published: 2015-10-18
Description: Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1913.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html; http://www.securityfocus.com/bid/77116
CVE: CVE-2015-6843
Published: 2015-10-18
Description: Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html; http://seclists.org/bugtraq/2015/Oct/58; http://www.securitytracker.com/id/1033787
CVE: CVE-2015-6844
Published: 2015-10-18
Description: Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html; http://seclists.org/bugtraq/2015/Oct/58; http://www.securitytracker.com/id/1033787
CVE: CVE-2015-6845
Published: 2015-10-18
Description: EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html; http://seclists.org/bugtraq/2015/Oct/58; http://www.securitytracker.com/id/1033787
CVE: CVE-2015-6846
Published: 2015-10-18
Description: EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts cryptographic operations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html; http://seclists.org/bugtraq/2015/Oct/58; http://www.securitytracker.com/id/1033787
CVE: CVE-2015-5661
Published: 2015-10-18
Description: The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN37825153/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000162; http://jvn.jp/en/jp/JVN37825153/index.html