deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7016
Published: 2015-10-23
Description: The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7018
Published: 2015-10-23
Description: FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; http://www.securityfocus.com/bid/77263
CVE: CVE-2015-7019
Published: 2015-10-23
Description: The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7020
Published: 2015-10-23
Description: The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7019.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7021
Published: 2015-10-23
Description: The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7023
Published: 2015-10-23
Description: CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; http://www.securityfocus.com/bid/77263
CVE: CVE-2015-1001
Published: 2015-10-25
Description: Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE: CVE-2015-1002
Published: 2015-10-25
Description: IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string.
CVSS Score: 6.4 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE: CVE-2015-1003
Published: 2015-10-25
Description: Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE: CVE-2015-1005
Published: 2015-10-25
Description: IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01
CVE: CVE-2015-6324
Published: 2015-10-25
Description: The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(2) allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug IDs CSCus56252 and CSCus57142.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-dhcp1; http://www.securitytracker.com/id/1033912; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-dhcp1
CVE: CVE-2015-6325
Published: 2015-10-25
Description: Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCut03495.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-dns1; http://www.securityfocus.com/bid/77260; http://www.securitytracker.com/id/1033913
CVE: CVE-2015-6326
Published: 2015-10-25
Description: Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCuu07799.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-dns2; http://www.securitytracker.com/id/1034156; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-dns2
CVE: CVE-2015-6327
Published: 2015-10-25
Description: The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.8), 9.2 before 9.2(4), and 9.3 before 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets, aka Bug ID CSCus94026.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-ike; http://www.securitytracker.com/id/1033914; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-asa-ike
CVE: CVE-2015-6335
Published: 2015-10-25
Description: The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-fmc; http://www.securitytracker.com/id/1033873; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-fmc
CVE: CVE-2015-6341
Published: 2015-10-25
Description: The Web Management GUI on Cisco Wireless LAN Controller (WLC) devices with software 7.4(140.0) and 8.0(120.0) allows remote attackers to cause a denial of service (client disconnection) via unspecified vectors, aka Bug ID CSCuw10610.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-wlc; http://www.securitytracker.com/id/1033871; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-wlc
CVE: CVE-2015-6484
Published: 2015-10-25
Description: 3S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted (1) GET or (2) POST request.
CVSS Score: 5.0 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-293-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-293-03
CVE: CVE-2015-4974
Published: 2015-10-26
Description: IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain root privileges for command execution via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005366; http://www-01.ibm.com/support/docview.wss?uid=swg21972152; http://www.securityfocus.com/bid/77025
CVE: CVE-2015-4981
Published: 2015-10-26
Description: IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain sensitive information from system memory via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005366; http://www-01.ibm.com/support/docview.wss?uid=swg21972152; http://www.securityfocus.com/bid/77027
CVE: CVE-2015-5011
Published: 2015-10-26
Description: IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.
CVSS Score: 3.2 (LOW)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139; http://www-01.ibm.com/support/docview.wss?uid=swg21967265; http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139
CVE: CVE-2015-5014
Published: 2015-10-26
Description: IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967228; http://www-01.ibm.com/support/docview.wss?uid=swg21967228
CVE: CVE-2015-5448
Published: 2015-10-26
Description: HP Asset Manager 9.40 and 9.41 before 9.41.11103 P4-rev1 and 9.50 before 9.50.11925 P3 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/77303; http://www.securitytracker.com/id/1033957; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04863562
CVE: CVE-2015-4456
Published: 2015-10-26
Description: ownCloud Desktop Client before 1.8.2 does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which allows man-in-the-middle attackers to bypass the user's certificate distrust decision and obtain sensitive information by leveraging a self-signed certificate and a connection to a server using its own self-signed certificate.
CVSS Score: 2.6 (LOW)
References: http://www.debian.org/security/2015/dsa-3363; http://www.securityfocus.com/bid/75354; https://github.com/owncloud/client/issues/3283
CVE: CVE-2015-5288
Published: 2015-10-26
Description: The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172316.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169094.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html
CVE: CVE-2015-5289
Published: 2015-10-26
Description: Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=08fa47c4850cea32c[PII_REDACTED]bca219fbf2fe6; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172316.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169094.html
CVE: CVE-2015-6500
Published: 2015-10-26
Description: Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-399
References: http://www.debian.org/security/2015/dsa-3373; https://owncloud.org/security/advisory/?id=oc-sa-2015-014; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-048.txt
CVE: CVE-2015-6670
Published: 2015-10-26
Description: ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.
CVSS Score: 4.0 (MEDIUM)
References: http://www.debian.org/security/2015/dsa-3373; https://owncloud.org/security/advisory/?id=oc-sa-2015-015; http://www.debian.org/security/2015/dsa-3373
CVE: CVE-2015-7298
Published: 2015-10-26
Description: ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate.  NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression.
CVSS Score: 5.1 (MEDIUM)
References: https://owncloud.org/security/advisory/?id=oc-sa-2015-016; https://owncloud.org/security/advisory/?id=oc-sa-2015-016
CVE: CVE-2015-7881
Published: 2015-10-26
Description: The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://www.drupal.org/node/2578165; https://www.drupal.org/node/2582071; https://www.drupal.org/node/2578165
CVE: CVE-2015-7699
Published: 2015-10-26
Description: The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore."
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3373; https://github.com/owncloud/core/pull/18558; https://owncloud.org/security/advisory/?id=oc-sa-2015-018
CVE: CVE-2014-8242
Published: 2015-10-26
Description: librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151105.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152355.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152366.html
CVE: CVE-2015-3280
Published: 2015-10-26
Description: OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2015-1898.html; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html; http://www.securityfocus.com/bid/76553
CVE: CVE-2015-5223
Published: 2015-10-26
Description: OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html; http://rhn.redhat.com/errata/RHSA-2015-1895.html; http://rhn.redhat.com/errata/RHSA-2016-0329.html
CVE: CVE-2015-5251
Published: 2015-10-26
Description: OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1897.html; https://bugs.launchpad.net/bugs/1482371; https://security.openstack.org/ossa/OSSA-2015-019.html
CVE: CVE-2015-5286
Published: 2015-10-26
Description: OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1897.html; http://www.securityfocus.com/bid/76943; https://bugs.launchpad.net/bugs/1498163
CVE: CVE-2015-7673
Published: 2015-10-26
Description: io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.32/gdk-pixbuf-2.32.0.news; http://lists.opensuse.org/opensuse-updates/2016-03/msg00124.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00006.html
CVE: CVE-2015-7674
Published: 2015-10-26
Description: Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.32/gdk-pixbuf-2.32.1.news; http://lists.opensuse.org/opensuse-updates/2016-03/msg00124.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00006.html
CVE: CVE-2015-3218
Published: 2015-10-26
Description: The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
CVSS Score: 2.1 (LOW)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161721.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162294.html; http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html
CVE: CVE-2015-3255
Published: 2015-10-26
Description: The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html
CVE: CVE-2015-3256
Published: 2015-10-26
Description: PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html
CVE: CVE-2015-4625
Published: 2015-10-26
Description: Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161721.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162294.html; http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html
CVE: CVE-2015-5665
Published: 2015-10-27
Description: Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN97278546/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000166; http://www.ec-cube.net/info/weakness/weakness.php?id=63
CVE: CVE-2015-6340
Published: 2015-10-27
Description: The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamgr process restart) via a crafted header in a PMIPv6 packet, aka Bug ID CSCuv63280.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-asrcdma; http://www.securitytracker.com/id/1033872; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151016-asrcdma
CVE: CVE-2015-3996
Published: 2015-10-27
Description: The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/76242; https://github.com/AFNetworking/AFNetworking/issues/2619; https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3
CVE: CVE-2015-5178
Published: 2015-10-27
Description: The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://rhn.redhat.com/errata/RHSA-2015-1904.html; http://rhn.redhat.com/errata/RHSA-2015-1905.html; http://rhn.redhat.com/errata/RHSA-2015-1906.html