deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16204
Published: 2020-02-05
Description: Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the switch and an external server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-905; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-4613
Published: 2020-02-05
Description: IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 168524.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168524; https://www.ibm.com/support/pages/node/1172860; https://exchange.xforce.ibmcloud.com/vulnerabilities/168524
CVE: CVE-2019-4616
Published: 2020-02-05
Description: IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 168644.
CVSS Score: 3.5 (LOW)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168644; https://www.ibm.com/support/pages/node/1289188; https://exchange.xforce.ibmcloud.com/vulnerabilities/168644
CVE: CVE-2019-4670
Published: 2020-02-05
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. IBM X-Force ID: 171319.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171319; https://www.ibm.com/support/pages/node/1289152; https://exchange.xforce.ibmcloud.com/vulnerabilities/171319
CVE: CVE-2020-6174
Published: 2020-02-05
Description: TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/theupdateframework/tuf/pull/974; https://github.com/theupdateframework/tuf/pull/974
CVE: CVE-2020-6969
Published: 2020-02-05
Description: It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://www.us-cert.gov/ics/advisories/icsa-20-035-01; https://www.us-cert.gov/ics/advisories/icsa-20-035-01
CVE: CVE-2020-7966
Published: 2020-02-05
Description: GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7967
Published: 2020-02-05
Description: GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7968
Published: 2020-02-05
Description: GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7969
Published: 2020-02-05
Description: GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
CVSS Score: 7.5 (HIGH)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7971
Published: 2020-02-05
Description: GitLab EE 11.0 and later through 12.7.2 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7972
Published: 2020-02-05
Description: GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7973
Published: 2020-02-05
Description: GitLab through 12.7.2 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://gitlab.com/gitlab-org/security/gitlab/issues/14
CVE: CVE-2020-7974
Published: 2020-02-05
Description: GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7976
Published: 2020-02-05
Description: GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7977
Published: 2020-02-05
Description: GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-7978
Published: 2020-02-05
Description: GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
CVSS Score: 7.5 (HIGH)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-8506
Published: 2020-02-05
Description: The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://packetstormsecurity.com/files/156425/Global-TV-Unencrypted-Analytics.html; https://www.info-sec.ca/advisories.html; https://www.info-sec.ca/advisories/Global-TV.html
CVE: CVE-2020-8507
Published: 2020-02-05
Description: The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/156426/Citytv-Video-Unencrypted-Analytics.html; https://www.info-sec.ca/advisories.html; https://www.info-sec.ca/advisories/Citytv-Video.html
CVE: CVE-2019-11516
Published: 2020-02-05
Description: An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry Responses (EIRs) are improperly handled, which causes a heap-based buffer overflow during device inquiry. This overflow can be used to overwrite existing functions with arbitrary code. The Reserved for Future Use (RFU) bits are not discarded by eir_handleRx(), and are included in an EIR's length. Therefore, one can exceed the expected 240 bytes, which leads to a heap-based buffer overflow in eir_getReceivedEIR() called by bthci_event_SendInquiryResultEvent(). In order to exploit this bug, an attacker must repeatedly connect to the victim's device in a short amount of time from different source addresses. This will cause the victim's Bluetooth stack to resolve the device names and therefore allocate buffers with attacker-controlled data. Due to the heap corruption, the name will be eventually written to an attacker-controlled location, leading to a write-what-where condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://community.cypress.com/thread/53681; https://source.android.com/security/bulletin/2019-08-01; https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-arbitrary-code-execution_2019-078/
CVE: CVE-2019-12180
Published: 2020-02-05
Description: An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
CVSS Score: 7.8 (HIGH)
References: https://lab.mediaservice.net/advisory/2020-04-readyapi-soapui.txt; https://lab.mediaservice.net/advisory/2020-04-readyapi-soapui.txt
CVE: CVE-2019-15126
Published: 2020-02-05
Description: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
CVSS Score: 3.1 (LOW)
CWE: CWE-367
References: http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-wifi-en
CVE: CVE-2020-6754
Published: 2020-02-05
Description: dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-434
References: https://dotcms.com/security/SI-54; https://github.com/dotCMS/core/issues/17796; https://dotcms.com/security/SI-54
CVE: CVE-2020-6833
Published: 2020-02-05
Description: An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.
CVSS Score: 7.5 (HIGH)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2013-2675
Published: 2020-02-05
Description: Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84092; https://www.securityfocus.com/bid/59724
CVE: CVE-2015-0102
Published: 2020-02-05
Description: IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694941; http://www.securityfocus.com/bid/74220; https://www.ibm.com/blogs/psirt/ibm-security-bulletin-authentication-session-cookie-in-ibm-workflow-for-bluemix-was-missing-secure-flag-cve-2015-0102/
CVE: CVE-2019-15253
Published: 2020-02-05
Description: A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs administrator credentials. This vulnerability affects Cisco DNA Center Software releases earlier than 1.3.0.6 and 1.3.1.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/157668/Cisco-Digital-Network-Architecture-Center-1.3.1.4-Cross-Site-Scripting.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190205-dnac-xss; http://packetstormsecurity.com/files/157668/Cisco-Digital-Network-Architecture-Center-1.3.1.4-Cross-Site-Scripting.html
CVE: CVE-2020-3110
Published: 2020-02-05
Description: A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to the targeted IP Camera. A successful exploit could allow the attacker to expose the affected IP Camera for remote code execution or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). This vulnerability is fixed in Video Surveillance 8000 Series IP Camera Firmware Release 1.0.7 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-ipcameras-rce-dos; http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
CVE: CVE-2020-3111
Published: 2020-02-05
Description: A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to the targeted IP phone. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-voip-phones-rce-dos; http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
CVE: CVE-2020-3118
Published: 2020-02-05
Description: A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 8.8 (HIGH)
CWE: CWE-134, CWE-787
References: http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce; http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
CVE: CVE-2020-3119
Published: 2020-02-05
Description: A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does not properly validate input for certain fields in a Cisco Discovery Protocol message. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. An successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-nxos-cdp-rce; http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
CVE: CVE-2020-3120
Published: 2020-02-05
Description: A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing check when the affected software processes Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to exhaust system memory, causing the device to reload. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-fxnxos-iosxr-cdp-dos; http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
CVE: CVE-2020-3123
Published: 2020-02-05
Description: A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs59062; https://security.gentoo.org/glsa/202003-46
CVE: CVE-2020-3149
Published: 2020-02-05
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by providing malicious data to a specific field within the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco ISE Software releases 2.7.0 and later contains the fix for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-DxJsRWRx; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-DxJsRWRx
CVE: CVE-2010-4815
Published: 2020-02-05
Description: Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://forum.coppermine-gallery.net/index.php/topic%2C63510.0.html; https://seclists.org/oss-sec/2010/q1/121; https://www.openwall.com/lists/oss-security/2011/08/19/7
CVE: CVE-2013-5989
Published: 2020-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4969. Reason: This candidate is a duplicate of CVE-2011-4969. Notes: All CVE users should reference CVE-2011-4969 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3893
Published: 2020-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0114. Reason: This candidate is a duplicate of CVE-2014-0114. Notes: All CVE users should reference CVE-2014-0114 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-5626
Published: 2020-02-05
Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (network-communications outage) via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01; http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf