deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2022
Published: 2016-06-08
Description: HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, and CVE-2016-2030.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05131085; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
CVE: CVE-2016-2024
Published: 2016-06-08
Description: HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05158380; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05158380
CVE: CVE-2016-2026
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-2027.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-2027
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-2026.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-2028
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-4357.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-2029
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-4358.
CVSS Score: 9.1 (CRITICAL)
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-2030
Published: 2016-06-08
Description: HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, and CVE-2016-2022.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05131085; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
CVE: CVE-2016-2078
Published: 2016-06-08
Description: Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/VMWARE-VSPHERE-FLASH-XSS.txt; http://packetstormsecurity.com/files/137189/VMWare-vSphere-Web-Client-6.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/538484/100/0/threaded
CVE: CVE-2016-4357
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2028.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-4358
Published: 2016-06-08
Description: HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2029.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
CVE: CVE-2016-4359
Published: 2016-06-08
Description: Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allows remote attackers to execute arbitrary code via a long -server_name value, aka ZDI-CAN-3516.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/90975; http://www.securitytracker.com/id/1036006; http://www.zerodayinitiative.com/advisories/ZDI-16-363
CVE: CVE-2016-4360
Published: 2016-06-08
Description: web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/90975; http://www.securitytracker.com/id/1036006; http://www.zerodayinitiative.com/advisories/ZDI-16-364
CVE: CVE-2016-4361
Published: 2016-06-08
Description: HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allow remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/90975; http://www.securitytracker.com/id/1036006; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423
CVE: CVE-2016-4362
Published: 2016-06-08
Description: HPE Insight Control server deployment allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 8.1 (HIGH)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800
CVE: CVE-2016-4363
Published: 2016-06-08
Description: HPE Insight Control server deployment allows remote attackers to modify data via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800
CVE: CVE-2016-4364
Published: 2016-06-08
Description: HPE Insight Control server deployment allows local users to gain privileges via unspecified vectors.
CVSS Score: 8.4 (HIGH)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800
CVE: CVE-2016-4365
Published: 2016-06-08
Description: HPE Insight Control server deployment allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150800
CVE: CVE-2016-4366
Published: 2016-06-08
Description: HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05131085; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
CVE: CVE-2016-4367
Published: 2016-06-08
Description: The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036050; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05164813; http://www.securitytracker.com/id/1036050
CVE: CVE-2016-4368
Published: 2016-06-08
Description: HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408
CVE: CVE-2016-4369
Published: 2016-06-08
Description: HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05164819; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05164819
CVE: CVE-2016-5108
Published: 2016-06-08
Description: Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html; http://www.debian.org/security/2016/dsa-3598; http://www.securityfocus.com/bid/90924
CVE: CVE-2016-2142
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:1038; https://access.redhat.com/errata/RHSA-2016:1038
CVE: CVE-2016-2149
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:1064; https://access.redhat.com/errata/RHSA-2016:1064
CVE: CVE-2016-2160
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://access.redhat.com/errata/RHSA-2016:1064; https://bugzilla.redhat.com/show_bug.cgi?id=1316127; https://github.com/openshift/origin/pull/7864
CVE: CVE-2016-3703
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2016:1094; https://access.redhat.com/errata/RHSA-2016:1095; https://access.redhat.com/errata/RHSA-2016:1094
CVE: CVE-2016-3708
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2016:1094; https://access.redhat.com/errata/RHSA-2016:1094
CVE: CVE-2016-3711
Published: 2016-06-08
Description: HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:1064; https://github.com/openshift/origin/pull/8334; https://access.redhat.com/errata/RHSA-2016:1064
CVE: CVE-2016-3738
Published: 2016-06-08
Description: Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://access.redhat.com/errata/RHSA-2016:1094; https://access.redhat.com/errata/RHSA-2016:1094
CVE: CVE-2015-1797
Published: 2016-06-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-2310
Published: 2016-06-09
Description: General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01
CVE: CVE-2016-4370
Published: 2016-06-09
Description: HPE Project and Portfolio Management Center (PPM) 9.2x and 9.3x before 9.32.0002 allows remote authenticated users to execute arbitrary commands or obtain sensitive information via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05167126; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05167126
CVE: CVE-2016-4510
Published: 2016-06-09
Description: The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/91077; http://www.zerodayinitiative.com/advisories/ZDI-16-404; https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01
CVE: CVE-2016-4523
Published: 2016-06-09
Description: The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/91077; http://www.zerodayinitiative.com/advisories/ZDI-16-405; https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01
CVE: CVE-2016-4532
Published: 2016-06-09
Description: Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/91077; http://www.zerodayinitiative.com/advisories/ZDI-16-403; https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01
CVE: CVE-2016-0749
Published: 2016-06-09
Description: The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00003.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00004.html; http://www.debian.org/security/2016/dsa-3596
CVE: CVE-2016-1581
Published: 2016-06-09
Description: LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.ubuntu.com/usn/USN-2988-1; https://linuxcontainers.org/lxd/news/; http://www.ubuntu.com/usn/USN-2988-1
CVE: CVE-2016-1582
Published: 2016-06-09
Description: LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.ubuntu.com/usn/USN-2988-1; https://linuxcontainers.org/lxd/news/; http://www.ubuntu.com/usn/USN-2988-1
CVE: CVE-2016-2150
Published: 2016-06-09
Description: SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00003.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00004.html; http://www.debian.org/security/2016/dsa-3596
CVE: CVE-2016-4447
Published: 2016-06-09
Description: The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
CVE: CVE-2016-4448
Published: 2016-06-09
Description: Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
CVE: CVE-2016-4449
Published: 2016-06-09
Description: XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN17535578/index.html; http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000066.html; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
CVE: CVE-2015-8268
Published: 2016-06-10
Description: The up.time agent in Idera Uptime Infrastructure Monitor 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://docs.uptimesoftware.com/display/UT/Release+Notes; http://jira.uptimesoftware.com/browse/UT-16039; http://www.kb.cert.org/vuls/id/204232
CVE: CVE-2016-0910
Published: 2016-06-10
Description: EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Jun/44; http://www.securitytracker.com/id/1036074; http://seclists.org/bugtraq/2016/Jun/44
CVE: CVE-2016-0916
Published: 2016-06-10
Description: EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://seclists.org/bugtraq/2016/Jun/43; http://www.securitytracker.com/id/1036075; http://seclists.org/bugtraq/2016/Jun/43
CVE: CVE-2016-1419
Published: 2016-06-10
Description: Cisco Access Point devices with software 8.2(102.43) allow remote attackers to cause a denial of service (device reload) via crafted ARP packets, aka Bug ID CSCuy55803.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160608-aironet; http://www.securitytracker.com/id/1036626; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160608-aironet
CVE: CVE-2016-1420
Published: 2016-06-10
Description: The installation component on Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.3(2f) mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCuz72347.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160609-apic; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160609-apic
CVE: CVE-2016-1421
Published: 2016-06-10
Description: A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to check the bounds of input data. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160609-ipp; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160609-ipp; https://www.tenable.com/security/research/tra-2020-24
CVE: CVE-2016-4326
Published: 2016-06-10
Description: The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.
CVSS Score: 9.8 (CRITICAL)
References: http://www.kb.cert.org/vuls/id/586503; http://www.kb.cert.org/vuls/id/586503
CVE: CVE-2016-4328
Published: 2016-06-10
Description: MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server.
CVSS Score: 9.8 (CRITICAL)
References: http://www.kb.cert.org/vuls/id/482135; http://www.kb.cert.org/vuls/id/482135