deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4144
Published: 2015-06-15
Description: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html; http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt; http://www.debian.org/security/2015/dsa-3397
CVE: CVE-2015-4145
Published: 2015-06-15
Description: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html; http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt; http://www.debian.org/security/2015/dsa-3397
CVE: CVE-2015-4146
Published: 2015-06-15
Description: The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html; http://w1.fi/security/2015-4/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch; http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt
CVE: CVE-2015-4152
Published: 2015-06-15
Description: Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html; http://www.securityfocus.com/archive/1/535725/100/0/threaded; https://www.elastic.co/blog/logstash-1-4-3-released
CVE: CVE-2015-4163
Published: 2015-06-15
Description: GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html
CVE: CVE-2015-4164
Published: 2015-06-15
Description: The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html
CVE: CVE-2015-4559
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91539; http://www.securitytracker.com/id/1032671; https://kc.mcafee.com/corporate/index?page=content&id=SB10121
CVE: CVE-2015-2804
Published: 2015-06-16
Description: The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132235/Alcatel-Lucent-OmniSwitch-Web-Interface-Weak-Session-ID.html; http://seclists.org/fulldisclosure/2015/Jun/22; http://www.securityfocus.com/archive/1/535731/100/0/threaded
CVE: CVE-2015-2805
Published: 2015-06-16
Description: Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2015/Jun/23; http://www.securityfocus.com/archive/1/535732/100/0/threaded
CVE: CVE-2015-3010
Published: 2015-06-16
Description: ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155576.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155631.html; http://rhn.redhat.com/errata/RHSA-2015-1092.html
CVE: CVE-2015-3205
Published: 2015-06-16
Description: libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function calls in the "lexer's memory clean-up procedure."
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/132257/Libmimedir-VCF-Memory-Corruption-Proof-Of-Concept.html; http://www.securityfocus.com/bid/75147; https://www.exploit-db.com/exploits/37249/
CVE: CVE-2015-3395
Published: 2015-06-16
Description: The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f7e1367f58263593e6cee3c282f7277d7ee9d553; http://www.debian.org/security/2015/dsa-3288; http://www.securityfocus.com/bid/74433
CVE: CVE-2015-4606
Published: 2015-06-16
Description: Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/extensions/repository/view/jobfair; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/; http://www.securityfocus.com/bid/75238
CVE: CVE-2015-4607
Published: 2015-06-16
Description: Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the fileadmin folder.
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-006/; http://www.securityfocus.com/bid/75248; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-006/
CVE: CVE-2015-4608
Published: 2015-06-16
Description: Cross-site scripting (XSS) vulnerability in the BE User Log (beko_beuserlog) extension 1.1.1 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-007/; http://www.securityfocus.com/bid/75247; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-007/
CVE: CVE-2015-4609
Published: 2015-06-16
Description: SQL injection vulnerability in the wt_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/wt_directory; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-008/; http://www.securityfocus.com/bid/75253
CVE: CVE-2015-4610
Published: 2015-06-16
Description: SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/locator; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-009/; http://www.securityfocus.com/bid/75262
CVE: CVE-2015-4611
Published: 2015-06-16
Description: SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/ncgov_smoelenboek; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-010/; http://www.securityfocus.com/bid/75259
CVE: CVE-2015-4612
Published: 2015-06-16
Description: SQL injection vulnerability in the "FAQ - Frequently Asked Questions" (js_faq) extension before 1.2.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/js_faq; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-012/; http://www.securityfocus.com/bid/75256
CVE: CVE-2015-4613
Published: 2015-06-16
Description: SQL injection vulnerability in the backend module in the Developer Log (devlog) extension before 2.11.4 for TYPO3 allows remote editors to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/devlog; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-011/; http://www.securityfocus.com/bid/75257
CVE: CVE-2015-4374
Published: 2015-06-16
Description: Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73215
CVE: CVE-2015-4398
Published: 2015-06-16
Description: Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73224
CVE: CVE-2015-0546
Published: 2015-06-17
Description: EMC Unified Infrastructure Manager/Provisioning (UIM/P) 4.1 allows remote attackers to bypass LDAP authentication by providing a valid account name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Jun/87; http://www.securitytracker.com/id/1032589; http://seclists.org/bugtraq/2015/Jun/87
CVE: CVE-2015-3316
Published: 2015-06-17
Description: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, allows local users to gain privileges via an unspecified environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150604-01-security-notice-for-ca-common-services.aspx; http://www.securityfocus.com/bid/75033; http://www.securitytracker.com/id/1032512
CVE: CVE-2015-3317
Published: 2015-06-17
Description: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly perform bounds checking, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150604-01-security-notice-for-ca-common-services.aspx; http://www.securityfocus.com/bid/75033; http://www.securitytracker.com/id/1032512
CVE: CVE-2015-3318
Published: 2015-06-17
Description: CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers (aka SystemEDGE) 12.6, 12.7, 12.8, and 12.9; and CA Workload Automation AE r11, r11.3, r11.3.5, and r11.3.6 on UNIX, does not properly validate an unspecified variable, which allows local users to gain privileges via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150604-01-security-notice-for-ca-common-services.aspx; http://www.securityfocus.com/bid/75033; http://www.securitytracker.com/id/1032512
CVE: CVE-2015-4183
Published: 2015-06-17
Description: Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39324; http://www.securityfocus.com/bid/75205; http://www.securitytracker.com/id/1032584
CVE: CVE-2015-4186
Published: 2015-06-17
Description: The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39347; http://www.securityfocus.com/bid/75195; http://www.securitytracker.com/id/1032583
CVE: CVE-2015-4188
Published: 2015-06-17
Description: SQL injection vulnerability in the Manager interface in Cisco Prime Collaboration 10.5(1) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug IDs CSCuu29910, CSCuu29928, and CSCuu59104.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39365; http://www.securityfocus.com/bid/75268; http://www.securitytracker.com/id/1032592
CVE: CVE-2015-4190
Published: 2015-06-17
Description: Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
CVSS Score: 4.3 (MEDIUM)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39380; http://www.securityfocus.com/bid/75271; http://www.securitytracker.com/id/1032593
CVE: CVE-2015-4550
Published: 2015-06-17
Description: The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39366; http://www.securityfocus.com/bid/75269; http://www.securitytracker.com/id/1032595
CVE: CVE-2012-6692
Published: 2015-06-17
Description: Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jun/40; http://www.securityfocus.com/bid/75196
CVE: CVE-2015-2665
Published: 2015-06-17
Description: Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html
CVE: CVE-2015-2803
Published: 2015-06-17
Description: SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132302/TYPO3-Extension-Akronymmanager-0.5.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/43; http://typo3.org/extensions/repository/view/sb_akronymmanager
CVE: CVE-2015-3429
Published: 2015-06-17
Description: Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html; http://packetstormsecurity.com/files/131802/WordPress-Twenty-Fifteen-4.2.1-Cross-Site-Scripting.html
CVE: CVE-2015-4336
Published: 2015-06-17
Description: cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html; http://www.securityfocus.com/bid/74943; http://www.vapid.dhs.org/advisory.php?v=121
CVE: CVE-2015-4337
Published: 2015-06-17
Description: Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html; http://www.securityfocus.com/bid/74943; http://www.vapid.dhs.org/advisory.php?v=121
CVE: CVE-2015-4338
Published: 2015-06-17
Description: Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html; http://www.securityfocus.com/bid/74943; http://www.vapid.dhs.org/advisory.php?v=121
CVE: CVE-2015-4342
Published: 2015-06-17
Description: SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2571; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html
CVE: CVE-2015-4414
Published: 2015-06-17
Description: Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132266/WordPress-SE-HTML5-Album-Audio-Player-1.1.0-Directory-Traversal.html; http://www.securityfocus.com/bid/75093; http://www.vapid.dhs.org/advisory.php?v=124
CVE: CVE-2015-4454
Published: 2015-06-17
Description: SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2572; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html
CVE: CVE-2015-2861
Published: 2015-06-18
Description: Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://vestacp.com/roadmap/#history; http://www.kb.cert.org/vuls/id/842780; http://www.securityfocus.com/bid/75215
CVE: CVE-2015-4628
Published: 2015-06-18
Description: SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/75301; https://bugs.limesurvey.org/view.php?id=9694; https://github.com/LimeSurvey/LimeSurvey/commit/b09edc0dbd18d8459ade4c7c941e562c16564f9e
CVE: CVE-2015-3422
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132341/SearchBlox-8.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535780/100/0/threaded; http://www.securityfocus.com/bid/75263