deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2855
Published: 2015-05-30
Description: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/498348; http://www.securityfocus.com/bid/74921; https://bto.bluecoat.com/security-advisory/sa96
CVE: CVE-2015-4138
Published: 2015-05-30
Description: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/498348; https://bto.bluecoat.com/security-advisory/sa96; http://www.kb.cert.org/vuls/id/498348
CVE: CVE-2015-6593
Published: 2015-05-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6593.  Reason: This candidate is a duplicate of CVE-2014-6593.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-6593 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-1010
Published: 2015-05-31
Description: Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/700915; https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02
CVE: CVE-2015-2948
Published: 2015-05-31
Description: Cross-site scripting (XSS) vulnerability in the image processor in Zenphoto before 1.4.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN68452022/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000070; http://www.securityfocus.com/bid/74895
CVE: CVE-2015-2949
Published: 2015-05-31
Description: Cross-site scripting (XSS) vulnerability in ZenPhoto20 1.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN51176150/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000071; http://www.securityfocus.com/bid/74889
CVE: CVE-2015-3292
Published: 2015-05-31
Description: The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-17
References: http://www.securityfocus.com/bid/74891; https://kb.netapp.com/support/index?page=content&id=9010037; http://www.securityfocus.com/bid/74891
CVE: CVE-2015-3939
Published: 2015-05-31
Description: Directory traversal vulnerability in the NC854 and NC856 modules for IDS RTU 850C devices allows remote authenticated users to read arbitrary files via unspecified vectors involving an internal web server, as demonstrated by reading a TELNET credentials file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/74900; https://ics-cert.us-cert.gov/advisories/ICSA-15-148-01; http://www.securityfocus.com/bid/74900
CVE: CVE-2015-0211
Published: 2015-06-01
Description: mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47920; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278611
CVE: CVE-2015-0212
Published: 2015-06-01
Description: Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48368; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278612
CVE: CVE-2015-0213
Published: 2015-06-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48106; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278613
CVE: CVE-2015-0214
Published: 2015-06-01
Description: message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48329; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278614
CVE: CVE-2015-0215
Published: 2015-06-01
Description: calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48017; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278615
CVE: CVE-2015-0216
Published: 2015-06-01
Description: access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278616
CVE: CVE-2015-0217
Published: 2015-06-01
Description: filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48546; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278617
CVE: CVE-2015-0218
Published: 2015-06-01
Description: Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47964; http://openwall.com/lists/oss-security/2015/01/19/1; https://moodle.org/mod/forum/discuss.php?d=278618
CVE: CVE-2015-1493
Published: 2015-06-01
Description: Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=af9a7937cc085f96bdbc4724cadec6eeae0242fc; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48980; http://openwall.com/lists/oss-security/2015/02/04/15
CVE: CVE-2015-2266
Published: 2015-06-01
Description: message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49204; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307380
CVE: CVE-2015-2267
Published: 2015-06-01
Description: mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307381
CVE: CVE-2015-2268
Published: 2015-06-01
Description: filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38466; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307382
CVE: CVE-2015-2269
Published: 2015-06-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49144; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307383
CVE: CVE-2015-2270
Published: 2015-06-01
Description: lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48804; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307384
CVE: CVE-2015-2271
Published: 2015-06-01
Description: tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49084; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307385
CVE: CVE-2015-2272
Published: 2015-06-01
Description: login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48691; http://openwall.com/lists/oss-security/2015/03/16/1; http://www.securityfocus.com/bid/73166
CVE: CVE-2015-2273
Published: 2015-06-01
Description: Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49364; http://openwall.com/lists/oss-security/2015/03/16/1; https://moodle.org/mod/forum/discuss.php?d=307387
CVE: CVE-2015-3174
Published: 2015-06-01
Description: mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49941; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74719
CVE: CVE-2015-3175
Published: 2015-06-01
Description: Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
CVSS Score: 5.8 (MEDIUM)
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49179; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74720
CVE: CVE-2015-3176
Published: 2015-06-01
Description: The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50099; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74644
CVE: CVE-2015-3177
Published: 2015-06-01
Description: Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
CVSS Score: 3.5 (LOW)
CWE: CWE-17
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74721
CVE: CVE-2015-3178
Published: 2015-06-01
Description: Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49718; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74726
CVE: CVE-2015-3179
Published: 2015-06-01
Description: login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74725
CVE: CVE-2015-3180
Published: 2015-06-01
Description: lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49788; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74729
CVE: CVE-2015-3181
Published: 2015-06-01
Description: files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restrictions by using web services to perform uploads after this capability has been revoked.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49994; http://openwall.com/lists/oss-security/2015/05/18/1; http://www.securityfocus.com/bid/74728
CVE: CVE-2014-0999
Published: 2015-06-02
Description: Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/95; http://www.exploit-db.com/exploits/37114
CVE: CVE-2014-8391
Published: 2015-06-02
Description: The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/95; http://www.securityfocus.com/archive/1/535592/100/0/threaded
CVE: CVE-2015-0759
Published: 2015-06-02
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39133; http://www.securitytracker.com/id/1032446; http://tools.cisco.com/security/center/viewAlert.x?alertId=39133
CVE: CVE-2015-0850
Published: 2015-06-02
Description: The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3275; https://fusionforge.org/forum/forum.php?forum_id=41; http://www.debian.org/security/2015/dsa-3275
CVE: CVE-2015-1945
Published: 2015-06-02
Description: Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21957776; http://www.securityfocus.com/bid/74929; http://www-01.ibm.com/support/docview.wss?uid=swg21957776
CVE: CVE-2015-2278
Published: 2015-06-02
Description: The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2015/May/50; http://seclists.org/fulldisclosure/2015/May/96
CVE: CVE-2015-2282
Published: 2015-06-02
Description: Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2015/May/50; http://seclists.org/fulldisclosure/2015/May/96
CVE: CVE-2015-2944
Published: 2015-06-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN61328139/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000069; http://www.securityfocus.com/bid/74839
CVE: CVE-2015-3982
Published: 2015-06-02
Description: The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/74960; https://www.djangoproject.com/weblog/2015/may/20/security-release/; http://www.securityfocus.com/bid/74960
CVE: CVE-2015-4050
Published: 2015-06-02
Description: FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
CVE: CVE-2015-4094
Published: 2015-06-02
Description: The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-295
References: http://www.info-sec.ca/advisories/Thycotic-SecretServer.html; http://www.info-sec.ca/advisories/Thycotic-SecretServer.html