deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3195
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability; http://www.securityfocus.com/bid/92453; http://www.securitytracker.com/id/1036550
CVE: CVE-2016-4451
Published: 2016-08-19
Description: The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://projects.theforeman.org/issues/15182; http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c; https://access.redhat.com/errata/RHSA-2018:0336
CVE: CVE-2016-4475
Published: 2016-08-19
Description: The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254
References: http://projects.theforeman.org/issues/15268; http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9; http://www.securityfocus.com/bid/92125
CVE: CVE-2016-4995
Published: 2016-08-19
Description: Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://projects.theforeman.org/issues/15490; http://projects.theforeman.org/projects/foreman/repository/revisions/c3c186de12be15e55d9582e54659f765304a1073; https://access.redhat.com/errata/RHSA-2018:0336
CVE: CVE-2016-5390
Published: 2016-08-19
Description: Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://projects.theforeman.org/issues/15653; http://www.securityfocus.com/bid/91770; https://bugzilla.redhat.com/show_bug.cgi?id=1355728
CVE: CVE-2016-5736
Published: 2016-08-19
Description: The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF2; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF2; BIG-IP DNS 12.x before 12.0.0 HF2; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 before HF16; BIG-IP GTM 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1; and BIG-IP PSM 11.4.0 through 11.4.1 improperly enables the anonymous IPsec IKE peer configuration object, which allows remote attackers to establish an IKE Phase 1 negotiation and possibly conduct brute-force attacks against Phase 2 negotiations via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securitytracker.com/id/1036618; https://support.f5.com/kb/en-us/solutions/public/k/10/sol10133477.html; http://www.securitytracker.com/id/1036618
CVE: CVE-2016-6254
Published: 2016-08-19
Description: Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://collectd.org/news.shtml; http://www.debian.org/security/2016/dsa-3636; https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18
CVE: CVE-2016-6319
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/16019; http://projects.theforeman.org/issues/16024; http://www.securityfocus.com/bid/92429
CVE: CVE-2016-6320
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/16022; http://www.securityfocus.com/bid/92431; https://access.redhat.com/errata/RHBA-2016:1885
CVE: CVE-2016-6493
Published: 2016-08-19
Description: Citrix XenApp 6.x before 6.5 HRP07 and 7.x before 7.9 and Citrix XenDesktop before 7.9 might allow attackers to weaken an unspecified security mitigation via vectors related to memory permission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: http://support.citrix.com/article/CTX215460; http://www.securityfocus.com/bid/92316; http://www.securitytracker.com/id/1036539
CVE: CVE-2016-0915
Published: 2016-08-22
Description: The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request, related to a "direct object reference vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Aug/71; http://www.securityfocus.com/bid/92394; http://www.securitytracker.com/id/1036557
CVE: CVE-2016-1476
Published: 2016-08-22
Description: Cross-site scripting (XSS) vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCuz03024.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-ip-phone-8800; http://www.securityfocus.com/bid/92404; http://www.securitytracker.com/id/1036595
CVE: CVE-2016-1479
Published: 2016-08-22
Description: Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP request, aka Bug ID CSCuz03038.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-ipp; http://www.securityfocus.com/bid/92515; http://www.securitytracker.com/id/1036646
CVE: CVE-2016-1485
Published: 2016-08-22
Description: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva46497.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-ise; http://www.securityfocus.com/bid/92518; http://www.securitytracker.com/id/1036647
CVE: CVE-2016-4376
Published: 2016-08-22
Description: HPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/92480; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05236212; http://www.securityfocus.com/bid/92480
CVE: CVE-2016-4377
Published: 2016-08-22
Description: HPE Smart Update in Storage Sizing Tool before 13.0, Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1, Power Advisor before 7.8.2, Insight Management Sizer before 16.12.1, Synergy Planning Tool before 3.3, SAP Sizing Tool before 16.12.1, Sizing Tool for SAP Business Suite powered by HANA before 16.11.1, Sizer for ConvergedSystems Virtualization before 16.7.1, Sizer for Microsoft Exchange Server before 16.12.1, Sizer for Microsoft Lync Server 2013 before 16.12.1, Sizer for Microsoft SharePoint 2013 before 16.13.1, Sizer for Microsoft SharePoint 2010 before 16.11.1, and Sizer for Microsoft Skype for Business Server 2015 before 16.5.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/92479; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05237578; http://www.securityfocus.com/bid/92479
CVE: CVE-2016-5817
Published: 2016-08-22
Description: SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01
CVE: CVE-2016-6359
Published: 2016-08-22
Description: Cross-site scripting (XSS) vulnerability in Cisco Transport Gateway Installation Software 4.1(4.0) on Smart Call Home Transport Gateway devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug IDs CSCva40650 and CSCva40817.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-sch; http://www.securityfocus.com/bid/92516; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-sch
CVE: CVE-2016-6361
Published: 2016-08-22
Description: The Aggregated MAC Protocol Data Unit (AMPDU) implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via a crafted AMPDU header, aka Bug ID CSCuz56288.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-aap; http://www.securityfocus.com/bid/92508; http://www.securitytracker.com/id/1036648
CVE: CVE-2016-6362
Published: 2016-08-22
Description: Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.110.0, 8.2.12x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow local users to gain privileges via crafted CLI parameters, aka Bug ID CSCuz24725.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-aap1; http://www.securityfocus.com/bid/92513; http://www.securitytracker.com/id/1036644
CVE: CVE-2016-6363
Published: 2016-08-22
Description: The rate-limit feature in the 802.11 protocol implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via crafted 802.11 frames, aka Bug ID CSCva06192.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-aap2; http://www.securityfocus.com/bid/92511; http://www.securitytracker.com/id/1036645
CVE: CVE-2016-1477
Published: 2016-08-23
Description: Cisco Connected Streaming Analytics 1.1.1 allows remote authenticated users to discover a notification service password by reading administrative pages, aka Bug ID CSCuz92891.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-csa; http://www.securityfocus.com/bid/92398; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-csa
CVE: CVE-2016-1484
Published: 2016-08-23
Description: Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-wms1; http://www.securityfocus.com/bid/92519; http://www.securitytracker.com/id/1036649
CVE: CVE-2016-6355
Published: 2016-08-23
Description: Memory leak in Cisco IOS XR 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of service (control-plane protocol outage) via crafted fragmented packets, aka Bug ID CSCux26791.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-iosxr; http://www.securityfocus.com/bid/92399; http://www.securitytracker.com/id/1036585
CVE: CVE-2016-6364
Published: 2016-08-23
Description: The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-ucm; http://www.securityfocus.com/bid/92517; http://www.securitytracker.com/id/1036650
CVE: CVE-2016-6365
Published: 2016-08-23
Description: Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepowermc; http://www.securityfocus.com/bid/92510; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepowermc
CVE: CVE-2016-5081
Published: 2016-08-24
Description: ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.kb.cert.org/vuls/id/301735; http://www.securityfocus.com/bid/92449; http://www.kb.cert.org/vuls/id/301735
CVE: CVE-2016-5645
Published: 2016-08-24
Description: Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this community.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/92428; https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01; http://www.securityfocus.com/bid/92428
CVE: CVE-2016-5650
Published: 2016-08-24
Description: ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.kb.cert.org/vuls/id/301735; http://www.securityfocus.com/bid/92449; http://www.kb.cert.org/vuls/id/301735
CVE: CVE-2016-5799
Published: 2016-08-24
Description: Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: http://www.securityfocus.com/bid/92606; https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01; http://www.securityfocus.com/bid/92606
CVE: CVE-2016-5812
Published: 2016-08-24
Description: Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain sensitive information by reading a configuration file.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92605; https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01; http://www.securityfocus.com/bid/92605
CVE: CVE-2016-6909
Published: 2016-08-24
Description: Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://fortiguard.com/advisory/FG-IR-16-023; http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html; http://www.securityfocus.com/bid/92523
CVE: CVE-2016-7089
Published: 2016-08-24
Description: WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/138393/ESCALATEPLOWMAN-WatchGuard-Privilege-Escalation.html; http://www.securityfocus.com/bid/92638; https://www.exploit-db.com/exploits/40270/
CVE: CVE-2016-4069
Published: 2016-08-25
Description: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html; http://www.openwall.com/lists/oss-security/2016/04/23/4; http://www.securityfocus.com/bid/92654
CVE: CVE-2016-6231
Published: 2016-08-25
Description: Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/Aug/30; http://www.info-sec.ca/advisories/Kaspersky-Safe-Browser.html; http://www.securityfocus.com/archive/1/539071/100/0/threaded
CVE: CVE-2016-4655
Published: 2016-08-25
Description: The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00005.html; http://www.securityfocus.com/bid/92651
CVE: CVE-2016-4656
Published: 2016-08-25
Description: The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html; http://www.securityfocus.com/bid/92652; http://www.securitytracker.com/id/1036694
CVE: CVE-2016-4657
Published: 2016-08-25
Description: WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html; http://www.securityfocus.com/bid/92653; http://www.securitytracker.com/id/1036694
CVE: CVE-2016-5673
Published: 2016-08-25
Description: UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by using a :: substring in between the IP address and port number.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.kb.cert.org/vuls/id/735416; http://www.kb.cert.org/vuls/id/BLUU-A9WQVP; http://www.securityfocus.com/bid/92348
CVE: CVE-2016-5681
Published: 2016-08-25
Description: Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10063; http://www.kb.cert.org/vuls/id/332115; http://www.securityfocus.com/bid/92427
CVE: CVE-2016-6369
Published: 2016-08-25
Description: Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160824-anyconnect; http://www.securityfocus.com/bid/92625; http://www.securitytracker.com/id/1036697
CVE: CVE-2016-1497
Published: 2016-08-26
Description: The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x before 11.6.1, and 12.0.0 before HF1 allows remote administrators to read Access Policy Manager (APM) access logs via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92671; http://www.securitytracker.com/id/1036631; https://support.f5.com/kb/en-us/solutions/public/k/31/sol31925518.html
CVE: CVE-2016-5023
Published: 2016-08-26
Description: Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/92670; http://www.securitytracker.com/id/1036624; https://support.f5.com/kb/en-us/solutions/public/k/19/sol19784568.html
CVE: CVE-2016-5383
Published: 2016-08-26
Description: The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-1634.html; http://www.securityfocus.com/bid/92585; http://rhn.redhat.com/errata/RHSA-2016-1634.html