deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2563
Published: 2015-03-20
Description: SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter.  NOTE: The cat parameter vector is already covered by CVE-2008-4157.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/58; http://tetraph.com/security/sql-injection-vulnerability/vastal-i-tech-phpvid-1-2-3-sql-injection-security-vulnerabilities/
CVE: CVE-2015-2564
Published: 2015-03-20
Description: SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/119169; http://packetstormsecurity.com/files/130691/ProjectSend-r561-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/30
CVE: CVE-2015-0669
Published: 2015-03-21
Description: The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 15.4S and 15.4(3)S allows remote attackers to modify configuration settings or cause a denial of service (partial service outage) by sending crafted Autonomic Networking (AN) messages on an intranet network, aka Bug ID CSCup62167.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37935; http://www.securitytracker.com/id/1031967; http://tools.cisco.com/security/center/viewAlert.x?alertId=37935
CVE: CVE-2015-0670
Published: 2015-03-21
Description: The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37946; http://www.securitytracker.com/id/1031969; http://tools.cisco.com/security/center/viewAlert.x?alertId=37946
CVE: CVE-2015-0898
Published: 2015-03-21
Description: futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN39175666/221504/index.html; http://jvn.jp/en/jp/JVN39175666/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000041
CVE: CVE-2015-0941
Published: 2015-03-22
Description: The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/894897; http://www.kb.cert.org/vuls/id/894897
CVE: CVE-2014-9261
Published: 2015-03-23
Description: The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/119412; http://packetstormsecurity.com/files/130739/Codoforum-2.5.1-Arbitrary-File-Download.html; http://security.szurek.pl/codoforum-251-arbitrary-file-download.html
CVE: CVE-2015-2289
Published: 2015-03-23
Description: Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.html; http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html; http://www.openwall.com/lists/oss-security/2015/03/14/1
CVE: CVE-2015-2676
Published: 2015-03-23
Description: Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/42; http://websecurity.com.ua/7644/
CVE: CVE-2015-2677
Published: 2015-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://ocportal.com/site/news/view/new-releases/ocportal-9-0-17-released.htm; http://ocportal.com/site/news/view/security_issues/xss-vulnerability-patch.htm; http://packetstormsecurity.com/files/130729/ocPortal-9.0.16-Cross-Site-Scripting.html
CVE: CVE-2015-2678
Published: 2015-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17; http://osvdb.org/show/osvdb/119394; http://packetstormsecurity.com/files/130771/GeniXCMS-0.0.1-Cross-Site-Scripting.html
CVE: CVE-2015-2679
Published: 2015-03-23
Description: Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17; http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16; http://osvdb.org/show/osvdb/119392
CVE: CVE-2015-2680
Published: 2015-03-23
Description: Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17; http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16; http://osvdb.org/show/osvdb/119391
CVE: CVE-2015-2681
Published: 2015-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/42; http://websecurity.com.ua/7644/
CVE: CVE-2015-0103
Published: 2015-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR50457; http://www-01.ibm.com/support/docview.wss?uid=swg21693270; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50457
CVE: CVE-2015-0105
Published: 2015-03-24
Description: Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR50162; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50607; http://www-01.ibm.com/support/docview.wss?uid=swg21694937
CVE: CVE-2015-0106
Published: 2015-03-24
Description: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR50795; http://www-01.ibm.com/support/docview.wss?uid=swg21694935; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50795
CVE: CVE-2015-0136
Published: 2015-03-24
Description: powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020608; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020608
CVE: CVE-2015-0137
Published: 2015-03-24
Description: IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, which allows man-in-the-middle attackers to spoof devices via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020611; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020611
CVE: CVE-2015-0527
Published: 2015-03-24
Description: EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130959/EMC-Documentum-xMS-Sensitive-Information-Disclosure.html; http://seclists.org/bugtraq/2015/Mar/134; http://packetstormsecurity.com/files/130959/EMC-Documentum-xMS-Sensitive-Information-Disclosure.html
CVE: CVE-2015-0817
Published: 2015-03-24
Description: The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00035.html
CVE: CVE-2015-0818
Published: 2015-03-24
Description: Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00035.html
CVE: CVE-2015-0158
Published: 2015-03-24
Description: Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52137; http://www-01.ibm.com/support/docview.wss?uid=swg1JR52322; http://www-01.ibm.com/support/docview.wss?uid=swg1JR52355
CVE: CVE-2015-0197
Published: 2015-03-24
Description: IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062; http://www-304.ibm.com/support/docview.wss?uid=swg21902662; http://www.securityfocus.com/bid/73282
CVE: CVE-2015-0198
Published: 2015-03-24
Description: IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 in certain cipherList configurations allows remote attackers to bypass authentication and execute arbitrary programs as root via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062; http://www-304.ibm.com/support/docview.wss?uid=swg21902662; http://www.securityfocus.com/bid/73278
CVE: CVE-2015-0199
Published: 2015-03-24
Description: The mmfslinux kernel module in IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service (memory corruption) via unspecified character-device ioctl calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062; http://www-304.ibm.com/support/docview.wss?uid=swg21902662; http://www.securityfocus.com/bid/73283
CVE: CVE-2015-0250
Published: 2015-03-24
Description: XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
CVSS Score: 6.4 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2015-0138.html; http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html; http://rhn.redhat.com/errata/RHSA-2016-0041.html
CVE: CVE-2015-0252
Published: 2015-03-24
Description: internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152882.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153094.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153829.html
CVE: CVE-2015-0261
Published: 2015-03-24
Description: Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0114.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153999.html
CVE: CVE-2015-0282
Published: 2015-03-24
Description: GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2015-1457.html; http://www.debian.org/security/2015/dsa-3191; http://www.gnutls.org/security.html
CVE: CVE-2015-1388
Published: 2015-03-24
Description: The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-004.txt; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-004.txt
CVE: CVE-2015-2153
Published: 2015-03-24
Description: The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0114.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153999.html
CVE: CVE-2015-2154
Published: 2015-03-24
Description: The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0114.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153999.html
CVE: CVE-2015-2155
Published: 2015-03-24
Description: The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2015-0114.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153834.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00084.html
CVE: CVE-2015-2265
Published: 2015-03-24
Description: The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://advisories.mageia.org/MGASA-2015-0132.html; http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7333; http://lists.opensuse.org/opensuse-updates/2015-07/msg00033.html
CVE: CVE-2015-2284
Published: 2015-03-24
Description: userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.zerodayinitiative.com/advisories/ZDI-15-107/; http://www.zerodayinitiative.com/advisories/ZDI-15-107/
CVE: CVE-2014-6134
Published: 2015-03-25
Description: IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7, when Installation Manager before 1.8.2 is used, retains cleartext server passwords in process memory throughout the installation procedure, which might allow local users to obtain sensitive information by leveraging access to the installation account.
CVSS Score: 1.2 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21688450; http://www-01.ibm.com/support/docview.wss?uid=swg21688450
CVE: CVE-2014-8923
Published: 2015-03-25
Description: The (1) IBM Tivoli Identity Manager Active Directory adapter before 5.1.24 and (2) IBM Security Identity Manager Active Directory adapter before 6.0.14 for IBM Security Identity Manager on Windows, when certain log and trace levels are configured, store the cleartext administrator password in a log file, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699902; http://www-01.ibm.com/support/docview.wss?uid=swg21699902
CVE: CVE-2014-8925
Published: 2015-03-25
Description: Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699148; http://www-01.ibm.com/support/docview.wss?uid=swg21699148
CVE: CVE-2015-0138
Published: 2015-03-25
Description: GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
CVE: CVE-2015-0159
Published: 2015-03-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3570.  Reason: This candidate is a reservation duplicate of CVE-2014-3570.  Notes: All CVE users should reference CVE-2014-3570 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-9711
Published: 2015-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130903/Websense-Explorer-Report-Scheduler-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/130905/Websense-Reporting-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/109
CVE: CVE-2015-0295
Published: 2015-03-25
Description: The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150800.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150940.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151034.html
CVE: CVE-2015-2316
Published: 2015-03-25
Description: The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html