deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8759
Published: 2016-01-08
Description: Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/; http://www.securityfocus.com/bid/79250; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/
CVE: CVE-2015-8760
Published: 2016-01-08
Description: The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/; http://www.securityfocus.com/bid/79210; http://www.securitytracker.com/id/1034485
CVE: CVE-2015-8761
Published: 2016-01-08
Description: The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94
References: http://cgit.drupalcode.org/values/commit/?id=5942ee9; http://www.securityfocus.com/bid/79656; https://www.drupal.org/node/2622534
CVE: CVE-2014-8886
Published: 2016-01-08
Description: AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: http://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html; http://seclists.org/fulldisclosure/2016/Jan/12; http://www.securityfocus.com/archive/1/537246/100/0/threaded
CVE: CVE-2015-4694
Published: 2016-01-08
Description: Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/06/12/4; http://www.openwall.com/lists/oss-security/2015/06/21/2; http://www.securityfocus.com/bid/75211
CVE: CVE-2015-8557
Published: 2016-01-08
Description: The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html; http://seclists.org/fulldisclosure/2015/Oct/4; http://www.debian.org/security/2016/dsa-3445
CVE: CVE-2015-8765
Published: 2016-01-08
Description: Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attackers to execute arbitrary code via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 8.3 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10144; https://www.kb.cert.org/vuls/id/576313; https://kc.mcafee.com/corporate/index?page=content&id=SB10144
CVE: CVE-2014-6444
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.g0blin.co.uk/cve-2014-6444/; https://wpvulndb.com/vulnerabilities/8233; https://research.g0blin.co.uk/cve-2014-6444/
CVE: CVE-2014-7151
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the form_fields parameter in a (1) do_edit or (2) do_insert action to wp-admin/admin-ajax.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.g0blin.co.uk/cve-2014-7151/; https://wpvulndb.com/vulnerabilities/8237; https://research.g0blin.co.uk/cve-2014-7151/
CVE: CVE-2015-7512
Published: 2016-01-08
Description: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-120
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f; http://rhn.redhat.com/errata/RHSA-2015-2694.html; http://rhn.redhat.com/errata/RHSA-2015-2695.html
CVE: CVE-2015-7541
Published: 2016-01-08
Description: The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-77
References: http://rubysec.com/advisories/CVE-2015-7541/; http://www.openwall.com/lists/oss-security/2016/01/05/2; https://github.com/quadule/colorscore/commit/570b5e854cecddd44d2047c44126aed951b61718
CVE: CVE-2015-8376
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Navigation Group, or (3) Label parameter to blueprints/sections/edit/1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Dec/101; http://seclists.org/fulldisclosure/2015/Dec/7; http://seclists.org/fulldisclosure/2015/Dec/101
CVE: CVE-2015-8766
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Dec/60; http://www.getsymphony.com/download/releases/version/2.6.4/; https://cybersecurityworks.com/zerodays/cve-2015-8766-getsymphoney.html
CVE: CVE-2016-1498
Published: 2016-01-08
Description: Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://owncloud.org/security/advisory/?id=oc-sa-2016-001; https://owncloud.org/security/advisory/?id=oc-sa-2016-001
CVE: CVE-2016-1499
Published: 2016-01-08
Description: ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
CVSS Score: 8.5 (HIGH)
CWE: CWE-200, CWE-399
References: http://packetstormsecurity.com/files/135158/ownCloud-8.2.1-8.1.4-8.0.9-Information-Exposure.html; http://www.securityfocus.com/archive/1/537244/100/0/threaded; http://www.securityfocus.com/archive/1/537556/100/0/threaded
CVE: CVE-2016-1500
Published: 2016-01-08
Description: ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2016-003; https://owncloud.org/security/advisory/?id=oc-sa-2016-003
CVE: CVE-2016-1501
Published: 2016-01-08
Description: ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://owncloud.org/security/advisory/?id=oc-sa-2016-004; https://owncloud.org/security/advisory/?id=oc-sa-2016-004
CVE: CVE-2016-1565
Published: 2016-01-08
Description: Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/node/2644832; https://www.drupal.org/node/2645350; https://www.drupal.org/node/2644832
CVE: CVE-2015-6933
Published: 2016-01-09
Description: The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2, VMware Player 7.x before 7.1.2, VMware Fusion 7.x before 7.1.2, and VMware ESXi 5.0 through 6.0 allows Windows guest OS users to gain guest OS privileges or cause a denial of service (guest OS kernel memory corruption) via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1034603; http://www.securitytracker.com/id/1034604; http://www.vmware.com/security/advisories/VMSA-2016-0001.html
CVE: CVE-2015-7085
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7086
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7087
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7088
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7089
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7090
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7091
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7092
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3 tag in MP3 data in a movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7117.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; http://www.zerodayinitiative.com/advisories/ZDI-16-002/
CVE: CVE-2015-7117
Published: 2016-01-09
Description: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7092.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00000.html; http://www.securitytracker.com/id/1034610; https://support.apple.com/HT205638
CVE: CVE-2015-7575
Published: 2016-01-09
Description: Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
CVE: CVE-2015-7938
Published: 2016-01-09
Description: Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01
CVE: CVE-2015-7939
Published: 2016-01-09
Description: Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-16-001; https://ics-cert.us-cert.gov/advisories/ICSA-15-274-02A; http://www.zerodayinitiative.com/advisories/ZDI-16-001
CVE: CVE-2015-8510
Published: 2016-01-09
Description: Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted web site that is mishandled during "Add to home screen" bookmarking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.mozilla.org/security/announce/2015/mfsa2015-153.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1190038; http://www.mozilla.org/security/announce/2015/mfsa2015-153.html
CVE: CVE-2015-8511
Published: 2016-01-09
Description: Race condition in the lockscreen feature in Mozilla Firefox OS before 2.5 allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://www.mozilla.org/security/announce/2015/mfsa2015-152.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1173284; http://www.mozilla.org/security/announce/2015/mfsa2015-152.html
CVE: CVE-2015-8512
Published: 2016-01-09
Description: The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proximate attackers to obtain access by entering many passcode guesses.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: http://www.mozilla.org/security/announce/2015/mfsa2015-151.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1181571; http://www.mozilla.org/security/announce/2015/mfsa2015-151.html
CVE: CVE-2015-7115
Published: 2016-01-10
Description: libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7116.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
CVE: CVE-2015-7116
Published: 2016-01-10
Description: libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7115.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
CVE: CVE-2015-7397
Published: 2016-01-10
Description: Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter.
CVSS Score: 7.4 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54295; http://www-01.ibm.com/support/docview.wss?uid=swg21969562; http://www-01.ibm.com/support/docview.wss?uid=swg24041142
CVE: CVE-2015-7465
Published: 2016-01-10
Description: Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972484; http://www-01.ibm.com/support/docview.wss?uid=swg21972484
CVE: CVE-2015-7466
Published: 2016-01-10
Description: Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors.
CVSS Score: 3.1 (LOW)
CWE: CWE-74
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972484; http://www-01.ibm.com/support/docview.wss?uid=swg21972484
CVE: CVE-2015-6980
Published: 2016-01-11
Description: Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7024
Published: 2016-01-11
Description: Untrusted search path vulnerability in Apple OS X before 10.11.1 allows local users to bypass intended Gatekeeper restrictions and gain privileges via a Trojan horse program that is loaded from an unexpected directory by an application that has a valid Apple digital signature.
CVSS Score: 6.7 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; https://support.apple.com/HT205375; http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
CVE: CVE-2015-7399
Published: 2016-01-11
Description: IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC99031; http://www-01.ibm.com/support/docview.wss?uid=swg21969672; http://www.securitytracker.com/id/1034999
CVE: CVE-2015-6566
Published: 2016-01-11
Description: zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-*.
CVSS Score: 8.4 (HIGH)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172605.html; https://download.zarafa.com/community/final/7.2/final-changelog-7.2.txt; https://jira.zarafa.com/browse/ZCP-13533
CVE: CVE-2015-7706
Published: 2016-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to api/v3/public/shares/downloads/, the (2) authType parameter to api/v3/auth/login, or the (3) login parameter to api/v3/auth/reset_password.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134760/Secure-Data-Space-3.1.1-2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Dec/36; http://www.securityfocus.com/archive/1/537069/100/0/threaded
CVE: CVE-2015-8230
Published: 2016-01-11
Description: Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461217.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461217.htm