deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4061
Published: 2016-04-22
Description: Foxit Reader and PhantomPDF before 7.3.4 on Windows allow remote attackers to cause a denial of service (application crash) via a crafted content stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/90504; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/90504
CVE: CVE-2016-4062
Published: 2016-04-22
Description: Foxit Reader and PhantomPDF before 7.3.4 on Windows improperly report format errors recursively, which allows remote attackers to cause a denial of service (application hang) via a crafted PDF.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/90504; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/90504
CVE: CVE-2016-4063
Published: 2016-04-22
Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via an object with a revision number of -1 in a PDF document.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/85379; http://www.zerodayinitiative.com/advisories/ZDI-16-219; http://www.zerodayinitiative.com/advisories/ZDI-16-220
CVE: CVE-2016-4064
Published: 2016-04-22
Description: Use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted remerge call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/85379; http://www.zerodayinitiative.com/advisories/ZDI-16-215; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2016-4065
Published: 2016-04-22
Description: The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 7.3.4 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted (1) JPEG, (2) GIF, or (3) BMP image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-16-216; http://www.zerodayinitiative.com/advisories/ZDI-16-217; http://www.zerodayinitiative.com/advisories/ZDI-16-218
CVE: CVE-2015-4829
Published: 2016-04-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-0638.  Reason: This candidate is a reservation duplicate of CVE-2016-0638.  Notes: All CVE users should reference CVE-2016-0638 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-8823
Published: 2016-04-22
Description: Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted text property, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.zerodayinitiative.com/advisories/ZDI-15-665; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html; http://www.zerodayinitiative.com/advisories/ZDI-15-665
CVE: CVE-2016-1036
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035671; https://helpx.adobe.com/security/products/analytics/apsb16-13.html; http://www.securitytracker.com/id/1035671
CVE: CVE-2016-1916
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to inject arbitrary web script or HTML by leveraging basic administrative access to create a crafted policy, leading to improper rendering on a certain Export IT screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.blackberry.com/btsc/KB38117; http://www.securitytracker.com/id/1035568; http://www.blackberry.com/btsc/KB38117
CVE: CVE-2016-1917
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1918.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.blackberry.com/btsc/KB38118; http://www.securitytracker.com/id/1035568; http://www.blackberry.com/btsc/KB38118
CVE: CVE-2016-1918
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1917.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.blackberry.com/btsc/KB38118; http://www.securitytracker.com/id/1035568; http://www.blackberry.com/btsc/KB38118
CVE: CVE-2016-2203
Published: 2016-04-22
Description: The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html; http://www.securityfocus.com/bid/86137; http://www.securitytracker.com/id/1035609
CVE: CVE-2016-2204
Published: 2016-04-22
Description: The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to obtain root-shell access via crafted terminal-window input.
CVSS Score: 8.2 (HIGH)
CWE: CWE-74
References: http://www.securityfocus.com/bid/86138; http://www.securitytracker.com/id/1035609; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00
CVE: CVE-2016-3126
Published: 2016-04-22
Description: Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.blackberry.com/btsc/KB38119; http://www.securitytracker.com/id/1035568; http://www.blackberry.com/btsc/KB38119
CVE: CVE-2015-5370
Published: 2016-04-25
Description: Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2110
Published: 2016-04-25
Description: The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2111
Published: 2016-04-25
Description: The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2112
Published: 2016-04-25
Description: The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2113
Published: 2016-04-25
Description: Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-310
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2114
Published: 2016-04-25
Description: The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-2115
Published: 2016-04-25
Description: Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://badlock.org/; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
CVE: CVE-2016-4006
Published: 2016-04-25
Description: epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth, which allows remote attackers to cause a denial of service (stack memory consumption and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685
CVE: CVE-2016-4076
Published: 2016-04-25
Description: epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035685; http://www.wireshark.org/security/wnpa-sec-2016-19.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11591
CVE: CVE-2016-4077
Published: 2016-04-25
Description: epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securitytracker.com/id/1035685; http://www.wireshark.org/security/wnpa-sec-2016-20.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11799
CVE: CVE-2016-4078
Published: 2016-04-25
Description: The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists, which allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted packet, related to epan/dissectors/packet-capwap.c and epan/dissectors/packet-ieee80211.c.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685; http://www.wireshark.org/security/wnpa-sec-2016-21.html
CVE: CVE-2016-4079
Published: 2016-04-25
Description: epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685
CVE: CVE-2016-4080
Published: 2016-04-25
Description: epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685
CVE: CVE-2016-4081
Published: 2016-04-25
Description: epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685
CVE: CVE-2016-4082
Published: 2016-04-25
Description: epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variable to index an array, which allows remote attackers to cause a denial of service (out-of-bounds access and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035685
CVE: CVE-2016-4083
Published: 2016-04-25
Description: epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array allocation, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035685; http://www.wireshark.org/security/wnpa-sec-2016-27.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12341
CVE: CVE-2016-4084
Published: 2016-04-25
Description: Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers to cause a denial of service (integer overflow and application crash) via a crafted packet that triggers an unexpected array size.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securitytracker.com/id/1035685; http://www.wireshark.org/security/wnpa-sec-2016-27.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12341
CVE: CVE-2016-4085
Published: 2016-04-25
Description: Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3585; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/87467
CVE: CVE-2015-8852
Published: 2016-04-25
Description: Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00064.html; http://www.debian.org/security/2016/dsa-3553; http://www.openwall.com/lists/oss-security/2016/04/16/1
CVE: CVE-2016-4051
Published: 2016-04-25
Description: Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-4052
Published: 2016-04-25
Description: Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-4053
Published: 2016-04-25
Description: Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
CVSS Score: 3.7 (LOW)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-4054
Published: 2016-04-25
Description: Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-1185
Published: 2016-04-25
Description: The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN89026267/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000055; http://www.securityfocus.com/bid/96842
CVE: CVE-2016-1202
Published: 2016-04-25
Description: Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN00324715/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000054; https://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d
CVE: CVE-2016-2331
Published: 2016-04-25
Description: The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/822980; http://www.kb.cert.org/vuls/id/822980
CVE: CVE-2016-2332
Published: 2016-04-25
Description: flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users to execute arbitrary commands via the 5066 (aka dnsmasq) parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.kb.cert.org/vuls/id/822980; http://www.kb.cert.org/vuls/id/822980
CVE: CVE-2016-2333
Published: 2016-04-25
Description: SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/822980; http://www.kb.cert.org/vuls/id/822980
CVE: CVE-2016-2346
Published: 2016-04-25
Description: Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: http://www.kb.cert.org/vuls/id/229047; https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/; http://www.kb.cert.org/vuls/id/229047
CVE: CVE-2015-3569
Published: 2016-04-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3569.  Reason: This candidate is a duplicate of CVE-2014-3569.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-3569 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-3571
Published: 2016-04-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3571.  Reason: This candidate is a duplicate of CVE-2014-3571.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-3571 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-3572
Published: 2016-04-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3572.  Reason: This candidate is a duplicate of CVE-2014-3572.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-3572 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage