deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0835
Published: 2015-02-25
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00006.html
CVE: CVE-2015-0836
Published: 2015-02-25
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00006.html
CVE: CVE-2014-9685
Published: 2015-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release; http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs; http://www.securitytracker.com/id/1031822
CVE: CVE-2015-2043
Published: 2015-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130490/MyConnection-Server-8.2b-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/130490/MyConnection-Server-8.2b-Cross-Site-Scripting.html
CVE: CVE-2015-2082
Published: 2015-02-25
Description: Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML via the txtUserID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130396/UNIT4-Prosoft-HRMS-8.14.230.47-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534705/100/0/threaded; http://www.securityfocus.com/bid/74896
CVE: CVE-2015-2083
Published: 2015-02-25
Description: Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130441/Ilch-CMS-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/bid/74898; http://packetstormsecurity.com/files/130441/Ilch-CMS-Cross-Site-Request-Forgery.html
CVE: CVE-2015-2084
Published: 2015-02-25
Description: Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html; http://seclists.org/fulldisclosure/2015/Feb/76; http://www.exploit-db.com/exploits/36161
CVE: CVE-2015-0633
Published: 2015-02-26
Description: The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0633; http://tools.cisco.com/security/center/viewAlert.x?alertId=37575; http://www.securityfocus.com/bid/72760
CVE: CVE-2015-2086
Published: 2015-02-26
Description: Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/72671; https://www.drupal.org/node/2428749; https://www.drupal.org/node/2428799
CVE: CVE-2015-2087
Published: 2015-02-26
Description: Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/72674; https://www.drupal.org/node/2427069; https://www.drupal.org/node/2428793
CVE: CVE-2015-2088
Published: 2015-02-26
Description: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/72678; https://www.drupal.org/node/2428483; https://www.drupal.org/node/2428853
CVE: CVE-2015-2089
Published: 2015-02-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130313/WordPress-Cross-Slide-2.0.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/74894; http://packetstormsecurity.com/files/130313/WordPress-Cross-Slide-2.0.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2015-2090
Published: 2015-02-26
Description: SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/118218; http://packetstormsecurity.com/files/130381/WordPress-Survey-And-Poll-1.1.7-Blind-SQL-Injection.html; http://www.exploit-db.com/exploits/36054
CVE: CVE-2014-2188
Published: 2015-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-0607.  Reason: This candidate is a duplicate of CVE-2015-0607.  The wrong ID was used.  Notes: All CVE users should reference CVE-2015-0607 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-0594
Published: 2015-02-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun18263.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0594; http://www.securityfocus.com/bid/72793; http://www.securitytracker.com/id/1031813
CVE: CVE-2015-0632
Published: 2015-02-27
Description: Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0632; http://www.securityfocus.com/bid/72797; http://www.securitytracker.com/id/1031816
CVE: CVE-2015-0651
Published: 2015-02-27
Description: Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0651; http://www.securityfocus.com/bid/72796; http://www.securitytracker.com/id/1031815
CVE: CVE-2015-0882
Published: 2015-02-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN44544694/281242/index.html; http://jvn.jp/en/jp/JVN44544694/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000027
CVE: CVE-2015-0883
Published: 2015-02-27
Description: SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN30135729/995637/index.html; http://jvn.jp/en/jp/JVN30135729/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000026
CVE: CVE-2015-0977
Published: 2015-02-27
Description: Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01
CVE: CVE-2015-1414
Published: 2015-02-27
Description: Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
CVSS Score: 7.8 (HIGH)
References: http://www.debian.org/security/2015/dsa-3175; http://www.securityfocus.com/bid/72777; http://www.securitytracker.com/id/1031798
CVE: CVE-2015-2072
Published: 2015-02-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs, aka SAP Note 2069676.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130519/SAP-HANA-Web-based-Development-Workbench-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Feb/91; http://www.securityfocus.com/archive/1/534747/100/0/threaded
CVE: CVE-2015-2075
Published: 2015-02-27
Description: SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130522/SAP-Business-Objects-Unauthorized-Audit-Information-Delete.html; http://seclists.org/fulldisclosure/2015/Feb/95; http://www.securityfocus.com/archive/1/534751/100/0/threaded
CVE: CVE-2015-2076
Published: 2015-02-27
Description: The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130523/SAP-Business-Objects-Unauthorized-Audit-Information-Access.html; http://seclists.org/fulldisclosure/2015/Feb/94; http://www.securityfocus.com/archive/1/534750/100/0/threaded
CVE: CVE-2015-2101
Published: 2015-02-27
Description: Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/72670; https://www.drupal.org/node/2428503; https://www.drupal.org/node/2428505
CVE: CVE-2015-2102
Published: 2015-02-27
Description: SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/118667; http://packetstormsecurity.com/files/130485/Clipbucket-2.7.0.4.v2929-rc3-Blind-SQL-Injection.html; http://www.exploit-db.com/exploits/36156
CVE: CVE-2015-2103
Published: 2015-02-27
Description: Cross-site scripting (XSS) vulnerability in the admin-login panel (admin/index.cgi) in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field (u_name parameter).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130403/Cosmoshop-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534710/100/0/threaded; http://packetstormsecurity.com/files/130403/Cosmoshop-Cross-Site-Scripting.html
CVE: CVE-2014-9676
Published: 2015-02-28
Description: The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/oss-sec/2015/q1/38; https://security.gentoo.org/glsa/201606-09; http://seclists.org/oss-sec/2015/q1/38
CVE: CVE-2014-9682
Published: 2015-02-28
Description: The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2014/11/11/6; https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d; https://github.com/skoranga/node-dns-sync/issues/1
CVE: CVE-2015-0655
Published: 2015-02-28
Description: Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0655; http://www.securityfocus.com/bid/72824; http://www.securitytracker.com/id/1031820
CVE: CVE-2015-0884
Published: 2015-02-28
Description: Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/vu/JVNVU99205169/index.html; http://www.kb.cert.org/vuls/id/632140; http://www.securitytracker.com/id/1031825
CVE: CVE-2015-0885
Published: 2015-02-28
Description: checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://checkpw.sourceforge.net/checkpw/changes.txt; http://jvn.jp/en/jp/JVN34790526/995575/index.html; http://jvn.jp/en/jp/JVN34790526/index.html
CVE: CVE-2015-0886
Published: 2015-02-28
Description: Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://jvn.jp/en/jp/JVN77718330/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000033; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html
CVE: CVE-2015-0887
Published: 2015-02-28
Description: npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN63949115/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000031; http://www.seil.jp/support/security/a01541.html
CVE: CVE-2015-0888
Published: 2015-02-28
Description: KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://jvn.jp/en/jp/JVN62298871/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000028; http://www.kent-web.com/bbs/clipbbs.html
CVE: CVE-2015-0889
Published: 2015-02-28
Description: KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN88862608/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000024; http://www.kent-web.com/bbs/joyful.html
CVE: CVE-2014-8921
Published: 2015-03-02
Description: The IBM Notes Traveler Companion application 1.0 and 1.1 before[PII_REDACTED]15 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by conducting a phishing attack involving an encrypted e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21690582; http://www-01.ibm.com/support/docview.wss?uid=swg21690582
CVE: CVE-2013-7421
Published: 2015-03-02
Description: The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.
CVSS Score: 2.1 (LOW)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d26a105b5a73e5635eae0629b42fa0a90e07b7b; http://rhn.redhat.com/errata/RHSA-2016-0068.html; http://www.debian.org/security/2015/dsa-3170
CVE: CVE-2014-8160
Published: 2015-03-02
Description: net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=db29a9508a9246e77087c5531e45b2c88ec6988b; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
CVE: CVE-2014-9644
Published: 2015-03-02
Description: The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.
CVSS Score: 2.1 (LOW)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4943ba16bbc2db05115707b3ff7b4874e9e3c560; http://rhn.redhat.com/errata/RHSA-2016-0068.html; http://www.debian.org/security/2015/dsa-3170
CVE: CVE-2015-0239
Published: 2015-03-02
Description: The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f3747379accba8e95d70cec0eae0582c8c182050; http://permalink.gmane.org/gmane.linux.kernel.commits.head/502245; http://rhn.redhat.com/errata/RHSA-2015-1272.html
CVE: CVE-2014-7896
Published: 2015-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before 7.6.1-06, and HP XP7 Global Link Manager Software (aka HGLM) 6.x through 8.x before 8.1.2-00, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031828; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04582371; http://www.securitytracker.com/id/1031828
CVE: CVE-2014-9283
Published: 2015-03-03
Description: The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/en/jp/JVN93727681/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000029; https://wordpress.org/plugins/captcha/changelog/
CVE: CVE-2014-9683
Published: 2015-03-03
Description: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.
CVSS Score: 3.6 (LOW)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=942080643bce061c3dd9d5718d3b745dcb39a8bc; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html; http://rhn.redhat.com/errata/RHSA-2015-1272.html
CVE: CVE-2015-0890
Published: 2015-03-03
Description: The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/en/jp/JVN55063777/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000030; https://wordpress.org/plugins/google-captcha/changelog/
CVE: CVE-2015-2168
Published: 2015-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none