deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7250
Published: 2015-12-30
Description: Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/77421; https://www.exploit-db.com/exploits/38773/; https://www.kb.cert.org/vuls/id/391604
CVE: CVE-2015-7251
Published: 2015-12-30
Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/77421; https://www.exploit-db.com/exploits/38773/; https://www.kb.cert.org/vuls/id/391604
CVE: CVE-2015-7252
Published: 2015-12-30
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/77421; https://www.exploit-db.com/exploits/38773/; https://www.kb.cert.org/vuls/id/391604
CVE: CVE-2015-7782
Published: 2015-12-30
Description: Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN35845584/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000188; http://jvn.jp/en/jp/JVN35845584/index.html
CVE: CVE-2015-7784
Published: 2015-12-30
Description: SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN55545372/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000190; http://www.ec-cube.net/products/detail.php?product_id=288
CVE: CVE-2015-7787
Published: 2015-12-30
Description: ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN69462495/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000192; http://www.asus.com/jp/News/FX04LE8HN0qBoqFI
CVE: CVE-2015-7788
Published: 2015-12-30
Description: ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN34489380/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000193; http://www.asus.com/jp/News/FX04LE8HN0qBoqFI
CVE: CVE-2015-7789
Published: 2015-12-30
Description: ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN85359294/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000194; http://www.asus.com/jp/News/FX04LE8HN0qBoqFI
CVE: CVE-2015-7790
Published: 2015-12-30
Description: Cross-site scripting (XSS) vulnerability on ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN89965717/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000195; http://www.asus.com/jp/News/FX04LE8HN0qBoqFI
CVE: CVE-2015-7792
Published: 2015-12-30
Description: Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://corega.jp/support/security/20151224_wlbargs.htm; http://jvn.jp/en/jp/JVN51349622/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000201
CVE: CVE-2015-7793
Published: 2015-12-30
Description: Corega CG-WLBARAGM devices provide an open proxy service, which allows remote attackers to trigger outbound network traffic via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-17
References: http://corega.jp/support/security/20151224_wlbaragm.htm; http://jvn.jp/en/jp/JVN50775659/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000202
CVE: CVE-2015-7794
Published: 2015-12-30
Description: Corega CG-WLNCM4G devices provide an open DNS resolver, which allows remote attackers to cause a denial of service (traffic amplification) via crafted queries.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://corega.jp/support/security/20151224_wlncm4g.htm; http://jvn.jp/en/jp/JVN51250073/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000203
CVE: CVE-2015-8703
Published: 2015-12-30
Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/77421; https://www.kb.cert.org/vuls/id/391604; https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA
CVE: CVE-2014-3260
Published: 2015-12-31
Description: Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-337-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-337-03
CVE: CVE-2014-4876
Published: 2015-12-31
Description: Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment variables via a crafted request to TCP port 54138.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://www.kb.cert.org/vuls/id/924506; https://www.kb.cert.org/vuls/id/JLAD-9X4TDL; https://www.kb.cert.org/vuls/id/924506
CVE: CVE-2015-2874
Published: 2015-12-31
Description: Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a default password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://www.kb.cert.org/vuls/id/903500; https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH; https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE: CVE-2015-2875
Published: 2015-12-31
Description: Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.kb.cert.org/vuls/id/903500; https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH; https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE: CVE-2015-2876
Published: 2015-12-31
Description: Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
CVSS Score: 8.8 (HIGH)
References: https://www.kb.cert.org/vuls/id/903500; https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH; https://www.kb.cert.org/vuls/id/GWAN-A26L3F
CVE: CVE-2015-2894
Published: 2015-12-31
Description: Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-134
References: https://www.kb.cert.org/vuls/id/377260; https://www.kb.cert.org/vuls/id/377260
CVE: CVE-2015-2895
Published: 2015-12-31
Description: Buffer overflow in the up.time client in Idera Uptime Infrastructure Monitor 7.4 might allow remote attackers to execute arbitrary code via long command input.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://www.kb.cert.org/vuls/id/377260; https://www.kb.cert.org/vuls/id/377260
CVE: CVE-2015-2896
Published: 2015-12-31
Description: The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, process, and event-log information via a command.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.kb.cert.org/vuls/id/377260; https://www.kb.cert.org/vuls/id/377260
CVE: CVE-2015-2912
Published: 2015-12-31
Description: The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/orientechnologies/orientdb/issues/4824; https://www.kb.cert.org/vuls/id/845332; https://github.com/orientechnologies/orientdb/issues/4824
CVE: CVE-2015-2913
Published: 2015-12-31
Description: server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104; https://www.kb.cert.org/vuls/id/845332; https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104
CVE: CVE-2015-2918
Published: 2015-12-31
Description: The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://www.kb.cert.org/vuls/id/845332; https://www.kb.cert.org/vuls/id/845332
CVE: CVE-2015-5994
Published: 2015-12-31
Description: The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the admin account and a default password of password for the medialink account, which allows remote attackers to obtain administrative privileges by leveraging a Wi-Fi session.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: https://www.kb.cert.org/vuls/id/630872; https://www.kb.cert.org/vuls/id/630872
CVE: CVE-2015-5995
Published: 2015-12-31
Description: Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://www.kb.cert.org/vuls/id/630872; https://www.kb.cert.org/vuls/id/630872
CVE: CVE-2015-5996
Published: 2015-12-31
Description: Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/45078/; https://www.kb.cert.org/vuls/id/630872; https://www.exploit-db.com/exploits/45078/
CVE: CVE-2015-6016
Published: 2015-12-31
Description: ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securitytracker.com/id/1034552; http://www.securitytracker.com/id/1034553; http://www.securitytracker.com/id/1034554
CVE: CVE-2015-6017
Published: 2015-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0) allow remote attackers to inject arbitrary web script or HTML via the (1) LoginPassword or (2) hiddenPassword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1034552; https://www.kb.cert.org/vuls/id/870744; https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R
CVE: CVE-2015-6018
Published: 2015-12-31
Description: The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034553; https://www.exploit-db.com/exploits/38455/; https://www.kb.cert.org/vuls/id/870744
CVE: CVE-2015-6019
Published: 2015-12-31
Description: The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
CVSS Score: 8.5 (HIGH)
References: http://www.securitytracker.com/id/1034553; https://www.kb.cert.org/vuls/id/870744; https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R
CVE: CVE-2015-6020
Published: 2015-12-31
Description: ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account.
CVSS Score: 8.0 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034553; https://www.kb.cert.org/vuls/id/870744; https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R
CVE: CVE-2015-7277
Published: 2015-12-31
Description: The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/78818; https://www.kb.cert.org/vuls/id/763576; http://www.securityfocus.com/bid/78818
CVE: CVE-2015-7278
Published: 2015-12-31
Description: Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/78818; https://www.kb.cert.org/vuls/id/763576; http://www.securityfocus.com/bid/78818
CVE: CVE-2015-7279
Published: 2015-12-31
Description: Amped Wireless R10000 devices with firmware 2.5.2.11 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/78818; https://www.kb.cert.org/vuls/id/763576; http://www.securityfocus.com/bid/78818
CVE: CVE-2015-7280
Published: 2015-12-31
Description: The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/78814; https://www.kb.cert.org/vuls/id/167992; http://www.securityfocus.com/bid/78814
CVE: CVE-2015-7281
Published: 2015-12-31
Description: Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/78814; https://www.kb.cert.org/vuls/id/167992; http://www.securityfocus.com/bid/78814
CVE: CVE-2015-7282
Published: 2015-12-31
Description: ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/78814; https://www.kb.cert.org/vuls/id/167992; http://www.securityfocus.com/bid/78814
CVE: CVE-2015-7283
Published: 2015-12-31
Description: The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/78819; http://www.securitytracker.com/id/1034554; https://www.kb.cert.org/vuls/id/330000
CVE: CVE-2015-7284
Published: 2015-12-31
Description: Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/78819; http://www.securitytracker.com/id/1034554; https://www.kb.cert.org/vuls/id/330000
CVE: CVE-2015-7447
Published: 2015-12-31
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF09 allows remote attackers to bypass intended Portal AccessControl REST API access restrictions and obtain sensitive information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI51395; http://www-01.ibm.com/support/docview.wss?uid=swg21973152; http://www.securityfocus.com/bid/79511
CVE: CVE-2015-1947
Published: 2015-12-31
Description: Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan horse library that is loaded by a setuid or setgid program.
CVSS Score: 7.4 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967131; http://www-304.ibm.com/support/docview.wss?uid=swg21970376; http://www.securityfocus.com/bid/79693
CVE: CVE-2015-5987
Published: 2015-12-31
Description: Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
CVSS Score: 8.6 (HIGH)
References: https://www.kb.cert.org/vuls/id/201168; https://www.kb.cert.org/vuls/id/201168
CVE: CVE-2015-5988
Published: 2015-12-31
Description: The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://www.kb.cert.org/vuls/id/201168; https://www.kb.cert.org/vuls/id/201168
CVE: CVE-2015-5989
Published: 2015-12-31
Description: Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://www.kb.cert.org/vuls/id/201168; https://www.kb.cert.org/vuls/id/201168
CVE: CVE-2015-5990
Published: 2015-12-31
Description: Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.kb.cert.org/vuls/id/201168; https://www.kb.cert.org/vuls/id/201168
CVE: CVE-2015-7441
Published: 2016-01-01
Description: Remote Artifact Loader (RAL) in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54760; http://www.securitytracker.com/id/1034531; http://www.securitytracker.com/id/1034532
CVE: CVE-2015-7489
Published: 2016-01-01
Description: IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973502; http://www.securitytracker.com/id/1034546; http://www-01.ibm.com/support/docview.wss?uid=swg21973502
CVE: CVE-2015-4941
Published: 2016-01-01
Description: IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972019; http://www.securityfocus.com/bid/79690; http://www.securitytracker.com/id/1034580
CVE: CVE-2015-4943
Published: 2016-01-01
Description: IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-17
References: http://www.securityfocus.com/bid/79689; http://www.securitytracker.com/id/1034581; https://www-01.ibm.com/support/docview.wss?uid=swg21972021
CVE: CVE-2015-5049
Published: 2016-01-01
Description: SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970590; http://www.securityfocus.com/bid/79682; http://www-01.ibm.com/support/docview.wss?uid=swg21970590
CVE: CVE-2015-7410
Published: 2016-01-01
Description: The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, which allows man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972676; http://www.securityfocus.com/bid/79685; http://www-01.ibm.com/support/docview.wss?uid=swg21972676
CVE: CVE-2015-7415
Published: 2016-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM UrbanCode Deploy 6.0 before 6.0.1.12, 6.1 before 6.1.3.2, and 6.2 before 6.2.0.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970811; http://www-01.ibm.com/support/docview.wss?uid=swg21970811
CVE: CVE-2015-7420
Published: 2016-01-01
Description: Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7421.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1023277; http://www-01.ibm.com/support/docview.wss?uid=swg21971500; http://www.securityfocus.com/bid/82301