deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4004
Published: 2015-06-07
Description: The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2015/06/05/7; http://www.securityfocus.com/bid/74669; http://www.ubuntu.com/usn/USN-2989-1
CVE: CVE-2014-6284
Published: 2015-06-08
Description: SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and response mechanism and obtain access to the probe account via a crafted response, aka SAP Security Note 2113995.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-004/?fid=6200; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-004/?fid=6200
CVE: CVE-2015-2993
Published: 2015-06-08
Description: SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-2994
Published: 2015-06-08
Description: Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-2995
Published: 2015-06-08
Description: The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.rapid7.com/db/modules/exploit/multi/http/sysaid_rdslogs_file_upload
CVE: CVE-2015-2996
Published: 2015-06-08
Description: Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-2997
Published: 2015-06-08
Description: SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-2998
Published: 2015-06-08
Description: SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-2999
Published: 2015-06-08
Description: Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a (2) TopAdministratorsByAverageTimer report or an (3) ActiveRequests report to /genericreport, (4) dir parameter to HelpDesk.jsp, or (5) grantSQL parameter to RFCGantt.jsp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-3000
Published: 2015-06-08
Description: SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an XML document to (1) /agententry, (2) /rdsmonitoringresponse, or (3) /androidactions, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-3001
Published: 2015-06-08
Description: SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jun/8; http://www.securityfocus.com/archive/1/535679/100/0/threaded
CVE: CVE-2015-3201
Published: 2015-06-08
Description: Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372; http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159788.html
CVE: CVE-2015-3905
Published: 2015-06-08
Description: Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://ubuntu.com/usn/usn-2627-1; http://www.openwall.com/lists/oss-security/2015/05/13/9; http://www.openwall.com/lists/oss-security/2015/05/22/10
CVE: CVE-2015-4051
Published: 2015-06-08
Description: Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service (reboot or shutdown), create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://ftp.beckhoff.com/download/document/IndustPC/Advisory-2015-001.pdf; http://packetstormsecurity.com/files/132168/Beckhoff-IPC-Diagnositcs-Authentication-Bypass.html; http://packetstormsecurity.com/files/134071/Beckoff-CX9020-CPU-Model-Remote-Code-Execution.html
CVE: CVE-2015-4053
Published: 2015-06-08
Description: The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2015-1092.html; http://tracker.ceph.com/issues/11694; http://www.openwall.com/lists/oss-security/2015/04/09/9
CVE: CVE-2014-9284
Published: 2015-06-09
Description: The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.7 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN50447904/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000085; http://jvn.jp/en/jp/JVN50447904/index.html
CVE: CVE-2015-2959
Published: 2015-06-09
Description: Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN25598413/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075; http://www.securityfocus.com/bid/75065
CVE: CVE-2015-2960
Published: 2015-06-09
Description: Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN98447310/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000074; http://www.securityfocus.com/bid/75071
CVE: CVE-2015-2961
Published: 2015-06-09
Description: Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN79284156/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000076; http://www.securityfocus.com/bid/75067
CVE: CVE-2015-4418
Published: 2015-06-09
Description: Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/75068; http://www.securitytracker.com/id/1032516; https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
CVE: CVE-2014-7872
Published: 2015-06-09
Description: Comodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local users to gain privileges by connecting to the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/135841/Comodo-Internet-Security-VNC-Server-Exposure.html; http://www.osvdb.org/122355; https://www.exploit-db.com/exploits/37065/
CVE: CVE-2015-3200
Published: 2015-06-09
Description: mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.html
CVE: CVE-2015-3436
Published: 2015-06-09
Description: provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html; http://www.securityfocus.com/bid/75104
CVE: CVE-2015-3624
Published: 2015-06-09
Description: Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote attackers to hijack the authentication of content administrators for requests that delete content via a delete action.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132104/Ektron-CMS-9.10-SP1-Cross-Site-Request-Forgery.html; http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulnerabilities-in-ektron-cms-9-10-sp1/; http://www.securityfocus.com/archive/1/535646/100/0/threaded
CVE: CVE-2015-3648
Published: 2015-06-09
Description: Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultlanguage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132142/ResourceSpace-7.1.6513-Local-File-Inclusion.html; http://svn.montala.com/websvn/revision.php?repname=ResourceSpace&path=%2F&rev=6640&peg=6738; http://www.securityfocus.com/archive/1/535669/100/0/threaded
CVE: CVE-2015-4010
Published: 2015-06-09
Description: Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9348&w=2; http://packetstormsecurity.com/files/132209/WordPress-Encrypted-Contact-Form-1.0.4-CSRF-XSS.html; http://seclists.org/fulldisclosure/2015/May/63
CVE: CVE-2015-4080
Published: 2015-06-09
Description: The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://packetstormsecurity.com/files/132210/Kankun-Smart-Socket-Mobile-App-Hardcoded-AES-Key.html; http://www.securityfocus.com/archive/1/535702/100/0/threaded; http://www.securityfocus.com/bid/75057
CVE: CVE-2015-4109
Published: 2015-06-09
Description: Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132181/WordPress-Users-Ultra-1.5.15-SQL-Injection.html; http://www.securityfocus.com/archive/1/535690/100/0/threaded; http://www.securityfocus.com/bid/75052
CVE: CVE-2015-4335
Published: 2015-06-09
Description: Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-17
References: http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.html
CVE: CVE-2015-4427
Published: 2015-06-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.114) allow remote authenticated users to inject arbitrary web script or HTML via the (1) page, (2) action, (3) folder_id, or (4) LangType parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132105/Ektron-CMS-9.10-SP1-Cross-Site-Scripting.html; http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulnerabilities-in-ektron-cms-9-10-sp1/; http://www.securityfocus.com/archive/1/535647/100/0/threaded
CVE: CVE-2015-2783
Published: 2015-06-09
Description: ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00004.html
CVE: CVE-2015-3307
Published: 2015-06-09
Description: The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://rhn.redhat.com/errata/RHSA-2015-1066.html; http://rhn.redhat.com/errata/RHSA-2015-1135.html
CVE: CVE-2015-3329
Published: 2015-06-09
Description: Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f59b67ae50064560d7bfcdb0d6a8ab284179053c; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-3330
Published: 2015-06-09
Description: The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=809610f5ea38a83b284e1125d1fff129bdd615e7; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2015-4021
Published: 2015-06-09
Description: The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
CVE: CVE-2015-4022
Published: 2015-06-09
Description: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
CVE: CVE-2015-4024
Published: 2015-06-09
Description: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
CVE: CVE-2015-4025
Published: 2015-06-09
Description: PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
CVE: CVE-2015-4026
Published: 2015-06-09
Description: The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
CVE: CVE-2015-4147
Published: 2015-06-09
Description: The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html; http://openwall.com/lists/oss-security/2015/06/01/4
CVE: CVE-2015-4148
Published: 2015-06-09
Description: The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00028.html; http://openwall.com/lists/oss-security/2015/06/01/4
CVE: CVE-2015-1687
Published: 2015-06-10
Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-19
References: http://www.securitytracker.com/id/1032521; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-056; http://www.securitytracker.com/id/1032521