deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1458
Published: 2015-02-03
Description: Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html; http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf; http://www.securityfocus.com/bid/72378
CVE: CVE-2015-1459
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html; http://secunia.com/advisories/62836; http://www.fortiguard.com/advisory/FG-IR-15-003/
CVE: CVE-2015-1460
Published: 2015-02-03
Description: Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-411975.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-411975.htm
CVE: CVE-2015-1461
Published: 2015-02-03
Description: ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148958.html
CVE: CVE-2015-1462
Published: 2015-02-03
Description: ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148958.html
CVE: CVE-2015-1463
Published: 2015-02-03
Description: ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148958.html
CVE: CVE-2014-8013
Published: 2015-02-03
Description: The TACACS+ command-authorization implementation in Cisco NX-OS allows local users to cause a denial of service (device reload) via a long CLI command, aka Bug ID CSCur54182.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8013; http://www.securityfocus.com/bid/72393; http://www.securitytracker.com/id/1031685
CVE: CVE-2014-8021
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier and Cisco HostScan Engine 3.1(.05183) and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8021; http://tools.cisco.com/security/center/viewAlert.x?alertId=37323; http://www.securityfocus.com/bid/72475
CVE: CVE-2015-0599
Published: 2015-02-03
Description: The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://secunia.com/advisories/62762; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0599; http://tools.cisco.com/security/center/viewAlert.x?alertId=37324
CVE: CVE-2015-0929
Published: 2015-02-03
Description: time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
CVSS Score: 10.0 (HIGH)
CWE: CWE-284
References: http://www.kb.cert.org/vuls/id/522460; http://www.kb.cert.org/vuls/id/522460
CVE: CVE-2015-0930
Published: 2015-02-03
Description: The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/522460; http://www.kb.cert.org/vuls/id/522460
CVE: CVE-2015-1469
Published: 2015-02-03
Description: time.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2.26a100 allows remote authenticated users to gain privileges by leveraging a cookie received in an HTTP response, a different vulnerability than CVE-2015-0929 and CVE-2015-0930.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/522460; http://www.kb.cert.org/vuls/id/522460
CVE: CVE-2014-7864
Published: 2015-02-04
Description: Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/114; http://www.securityfocus.com/archive/1/534575/100/0/threaded
CVE: CVE-2014-9331
Published: 2015-02-04
Description: Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/[PII_REDACTED]82/roleMgmt.do.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130219/ManageEngine-Desktop-Central-9-Cross-Site-Request-Forgery.html; http://www.exploit-db.com/exploits/35980; http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html
CVE: CVE-2015-1437
Published: 2015-02-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534579/100/0/threaded; http://www.securityfocus.com/archive/1/534580/100/0/threaded
CVE: CVE-2015-1475
Published: 2015-02-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to (a) board_entry.php or (b) forum_entry.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130220/My-Little-Forum-2.3.3-2.2-1.7-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Feb/15; http://tetraph.com/security/xss-vulnerability/my-little-forum-multiple-xss-security-vulnerabilities/
CVE: CVE-2015-1476
Published: 2015-02-04
Description: Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/117569; http://osvdb.org/show/osvdb/117570; http://packetstormsecurity.com/files/130073/ecommerceMajor-SQL-Injection.html
CVE: CVE-2015-1477
Published: 2015-02-04
Description: SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/117567; http://packetstormsecurity.com/files/130093/JClassifiedsManager-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/35911
CVE: CVE-2015-1478
Published: 2015-02-04
Description: Cross-site scripting (XSS) vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the view parameter to /classifieds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/117568; http://packetstormsecurity.com/files/130093/JClassifiedsManager-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/35911
CVE: CVE-2015-1479
Published: 2015-02-04
Description: SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130079/ManageEngine-ServiceDesk-9.0-SQL-Injection.html; http://www.exploit-db.com/exploits/35890; http://www.manageengine.com/products/service-desk/readme-9.0.html
CVE: CVE-2015-1480
Published: 2015-02-04
Description: ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/show/osvdb/117499; http://packetstormsecurity.com/files/130081/ManageEngine-ServiceDesk-Plus-9.0-Privilege-Escalation.html; http://www.exploit-db.com/exploits/35904
CVE: CVE-2014-5341
Published: 2015-02-04
Description: The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-019; https://owncloud.org/security/advisory/?id=oc-sa-2014-019
CVE: CVE-2014-9041
Published: 2015-02-04
Description: The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-027; https://owncloud.org/security/advisory/?id=oc-sa-2014-027
CVE: CVE-2014-9042
Published: 2015-02-04
Description: Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol.  NOTE: this can be leveraged by remote attackers using CVE-2014-9041.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-028; https://owncloud.org/security/advisory/?id=oc-sa-2014-028
CVE: CVE-2014-9043
Published: 2015-02-04
Description: The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-020; https://owncloud.org/security/advisory/?id=oc-sa-2014-020
CVE: CVE-2014-9044
Published: 2015-02-04
Description: Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-021; https://owncloud.org/security/advisory/?id=oc-sa-2014-021
CVE: CVE-2014-9045
Published: 2015-02-04
Description: The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-022; https://owncloud.org/security/advisory/?id=oc-sa-2014-022
CVE: CVE-2014-9046
Published: 2015-02-04
Description: The OC_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files via a file:// protocol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-023; https://owncloud.org/security/advisory/?id=oc-sa-2014-023
CVE: CVE-2014-9047
Published: 2015-02-04
Description: Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-026; https://owncloud.org/security/advisory/?id=oc-sa-2014-026
CVE: CVE-2014-9048
Published: 2015-02-04
Description: The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files via the API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-024; https://owncloud.org/security/advisory/?id=oc-sa-2014-024
CVE: CVE-2014-9049
Published: 2015-02-04
Description: The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an unspecified API method.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2014-025; https://owncloud.org/security/advisory/?id=oc-sa-2014-025
CVE: CVE-2014-9562
Published: 2015-02-04
Description: Cross-site scripting (XSS) vulnerability in display_dialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Feb/8; http://tetraph.com/security/cves/cve-2014-9562-optimalsite-content-management-system-cms-xss-cross-site-scripting-security-vulnerabilities/; http://seclists.org/fulldisclosure/2015/Feb/8
CVE: CVE-2015-1481
Published: 2015-02-04
Description: Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html; http://seclists.org/fulldisclosure/2015/Jan/52; http://www.exploit-db.com/exploits/35786
CVE: CVE-2015-1482
Published: 2015-02-04
Description: Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html; http://seclists.org/fulldisclosure/2015/Jan/52; http://www.exploit-db.com/exploits/35786
CVE: CVE-2015-0314
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0315
Published: 2015-02-06
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0320, and CVE-2015-0322.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0316
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0317
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0319.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0318
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0319
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0317.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0320
Published: 2015-02-06
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0322.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0321
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0322
Published: 2015-02-06
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0320.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0323
Published: 2015-02-06
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0324
Published: 2015-02-06
Description: Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2015-0325
Published: 2015-02-06
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0326 and CVE-2015-0328.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html