deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2255
Published: 2017-06-08
Description: Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-19
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417840.htm; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417840.htm
CVE: CVE-2015-2800
Published: 2017-06-08
Description: The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with software before V200R001SPH015 allows remote attackers to cause a denial of service (device restart) via vectors involving authentication, which trigger an array access violation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-418554.htm; http://www.securityfocus.com/bid/73355; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-418554.htm
CVE: CVE-2017-5878
Published: 2017-06-08
Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2017/05/22/2; https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true; http://www.openwall.com/lists/oss-security/2017/05/22/2
CVE: CVE-2017-8108
Published: 2017-06-08
Description: Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.securityfocus.com/bid/99288; https://cisofy.com/security/cve/cve-2017-8108/; https://github.com/CISOfy/lynis/releases/tag/2.5.0
CVE: CVE-2017-9022
Published: 2017-06-08
Description: The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.debian.org/security/2017/dsa-3866; http://www.securityfocus.com/bid/98760; http://www.ubuntu.com/usn/USN-3301-1
CVE: CVE-2017-9023
Published: 2017-06-08
Description: The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: http://www.debian.org/security/2017/dsa-3866; http://www.securityfocus.com/bid/98756; http://www.ubuntu.com/usn/USN-3301-1
CVE: CVE-2017-9310
Published: 2017-06-08
Description: QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-835
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4154c7e03fa55b4cf52509a83d50d6c09d743b7; http://www.debian.org/security/2017/dsa-3920; http://www.openwall.com/lists/oss-security/2017/05/31/1
CVE: CVE-2017-9330
Published: 2017-06-08
Description: QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-835
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=26f670a244982335cc08943fb1ec099a2c81e42d; http://www.debian.org/security/2017/dsa-3920; http://www.openwall.com/lists/oss-security/2017/06/01/3
CVE: CVE-2014-3498
Published: 2017-06-08
Description: The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1335551; https://github.com/ansible/ansible/commit/8ed6350e65c82292a631f08845dfaacffe7f07f5; https://bugzilla.redhat.com/show_bug.cgi?id=1335551
CVE: CVE-2016-2034
Published: 2017-06-08
Description: SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-009.txt; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-009.txt
CVE: CVE-2016-3091
Published: 2017-06-08
Description: Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.openwall.com/lists/oss-security/2016/05/17/8; http://www.openwall.com/lists/oss-security/2016/05/17/8
CVE: CVE-2016-3107
Published: 2017-06-08
Description: The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/05/20/1; https://access.redhat.com/errata/RHBA-2016:1501; https://bugzilla.redhat.com/attachment.cgi?id=1146471
CVE: CVE-2016-3108
Published: 2017-06-08
Description: The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2016/05/20/1; https://access.redhat.com/errata/RHBA-2016:1501; https://bugzilla.redhat.com/attachment.cgi?id=1146475
CVE: CVE-2016-3111
Published: 2017-06-08
Description: pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317; http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620; http://www.openwall.com/lists/oss-security/2016/05/20/1
CVE: CVE-2016-3112
Published: 2017-06-08
Description: client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/05/20/1; https://access.redhat.com/errata/RHBA-2016:1501; https://bugzilla.redhat.com/attachment.cgi?id=1146538
CVE: CVE-2016-3690
Published: 2017-06-08
Description: The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/99079; https://access.redhat.com/solutions/178393; https://access.redhat.com/solutions/45530
CVE: CVE-2016-4457
Published: 2017-06-08
Description: CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.securitytracker.com/id/1038599; https://access.redhat.com/errata/RHSA-2017:1367; https://access.redhat.com/errata/RHSA-2017:1601
CVE: CVE-2016-4471
Published: 2017-06-08
Description: ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=1340763; https://github.com/ManageIQ/manageiq/pull/7856; https://bugzilla.redhat.com/show_bug.cgi?id=1340763
CVE: CVE-2016-3095
Published: 2017-06-08
Description: server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182006.html; http://www.openwall.com/lists/oss-security/2016/04/06/3; http://www.openwall.com/lists/oss-security/2016/04/18/11
CVE: CVE-2016-3099
Published: 2017-06-08
Description: mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184345.html
CVE: CVE-2016-4992
Published: 2017-06-08
Description: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2594.html; http://rhn.redhat.com/errata/RHSA-2016-2765.html; https://bugzilla.redhat.com/show_bug.cgi?id=1347760
CVE: CVE-2016-5405
Published: 2017-06-08
Description: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-199
References: http://rhn.redhat.com/errata/RHSA-2016-2594.html; http://rhn.redhat.com/errata/RHSA-2016-2765.html; http://www.securityfocus.com/bid/93884
CVE: CVE-2016-5416
Published: 2017-06-08
Description: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2594.html; http://rhn.redhat.com/errata/RHSA-2016-2765.html; http://www.securityfocus.com/bid/99097
CVE: CVE-2016-7050
Published: 2017-06-08
Description: SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://rhn.redhat.com/errata/RHSA-2016-2604.html; https://bugzilla.redhat.com/show_bug.cgi?id=1378613; http://rhn.redhat.com/errata/RHSA-2016-2604.html
CVE: CVE-2017-4918
Published: 2017-06-08
Description: VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.securityfocus.com/bid/98984; http://www.securitytracker.com/id/1038642; https://www.vmware.com/security/advisories/VMSA-2017-0011.html
CVE: CVE-2014-7919
Published: 2017-06-08
Description: b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference and process crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/99014; https://android.googlesource.com/platform/frameworks/native/+/ae33effd43a615183f089f0a216b5965e8104842%5E%21/#F0; https://github.com/alexpark07/Bookmark/blob/master/BugHunting.md
CVE: CVE-2016-4473
Published: 2017-06-08
Description: /ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code.  NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.securityfocus.com/bid/98999
CVE: CVE-2016-5648
Published: 2017-06-08
Description: Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://packetstormsecurity.com/files/137775/Acer-Portal-Android-Application-3.9.3.2006-Man-In-The-Middle.html; http://seclists.org/fulldisclosure/2016/Jul/17; http://www.securityfocus.com/archive/1/538851/100/0/threaded
CVE: CVE-2016-6594
Published: 2017-06-08
Description: Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentication, and payload scanning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/91404; https://bto.bluecoat.com/security-advisory/sa130; http://www.securityfocus.com/bid/91404
CVE: CVE-2015-1379
Published: 2017-06-08
Description: The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.dest-unreach.org/socat/; http://www.openwall.com/lists/oss-security/2015/01/27/19; http://www.openwall.com/lists/oss-security/2015/04/06/4
CVE: CVE-2015-1588
Published: 2017-06-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131649/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535388/100/1100/threaded; http://www.securityfocus.com/bid/74350
CVE: CVE-2015-1786
Published: 2017-06-08
Description: Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1207781; https://framework.zend.com/changelog/2.3.6; https://bugzilla.redhat.com/show_bug.cgi?id=1207781
CVE: CVE-2015-2692
Published: 2017-06-08
Description: AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284
References: https://github.com/kzar/watchadblock/commit/5b77de6ea77e0eff2aa726d9722d64fb4964b985; https://www.greinr.com/blog/2015/cve-2015-2692-adblock-filter-injection/; https://github.com/kzar/watchadblock/commit/5b77de6ea77e0eff2aa726d9722d64fb4964b985
CVE: CVE-2015-3634
Published: 2017-06-08
Description: The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/05/02/12; http://www.securityfocus.com/bid/74453; https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
CVE: CVE-2015-3913
Published: 2017-06-08
Description: The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-427449.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-427449.htm
CVE: CVE-2016-6093
Published: 2017-06-08
Description: IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.ibm.com/support/docview.wss?uid=swg21997956; http://www.securityfocus.com/bid/95985; https://exchange.xforce.ibmcloud.com/vulnerabilities/118172
CVE: CVE-2016-6098
Published: 2017-06-08
Description: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21997958; http://www.securityfocus.com/bid/95982; https://exchange.xforce.ibmcloud.com/vulnerabilities/118254
CVE: CVE-2016-8987
Published: 2017-06-08
Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21996255; http://www.securityfocus.com/bid/97369; https://exchange.xforce.ibmcloud.com/vulnerabilities/119039
CVE: CVE-2016-9698
Published: 2017-06-08
Description: IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999960.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg21999960; http://www.ibm.com/support/docview.wss?uid=swg22002258; http://www.securityfocus.com/bid/96829
CVE: CVE-2016-9736
Published: 2017-06-08
Description: IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991469; http://www.ibm.com/support/docview.wss?uid=swg21996820; http://www.securityfocus.com/bid/96076
CVE: CVE-2016-9991
Published: 2017-06-08
Description: IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 121314.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21998167; http://www.securityfocus.com/bid/96084; https://exchange.xforce.ibmcloud.com/vulnerabilities/121314
CVE: CVE-2017-1140
Published: 2017-06-08
Description: IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999133; http://www.securityfocus.com/bid/97322; https://exchange.xforce.ibmcloud.com/vulnerabilities/121905
CVE: CVE-2017-1179
Published: 2017-06-08
Description: IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123431.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg22004161; http://www.securityfocus.com/bid/98910; https://exchange.xforce.ibmcloud.com/vulnerabilities/123431
CVE: CVE-2017-1319
Published: 2017-06-08
Description: IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie. IBM X-Force ID: 125731.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www-01.ibm.com/support/docview.wss?uid=swg22002871; http://www.securitytracker.com/id/1038504; https://exchange.xforce.ibmcloud.com/vulnerabilities/125731
CVE: CVE-2017-9523
Published: 2017-06-09
Description: The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.2.html; http://www.securityfocus.com/bid/99016; http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.2.html
CVE: CVE-2016-7469
Published: 2017-06-09
Description: A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95320; http://www.securitytracker.com/id/1037559; http://www.securitytracker.com/id/1037560
CVE: CVE-2016-4902
Published: 2017-06-09
Description: Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/94087; https://jvn.jp/en/jp/JVN91002412/index.html; http://www.securityfocus.com/bid/94087
CVE: CVE-2016-4906
Published: 2017-06-09
Description: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94969; https://jvn.jp/en/jp/JVN12281353/index.html; https://support.cybozu.com/ja-jp/article/9511
CVE: CVE-2016-4907
Published: 2017-06-09
Description: Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94965; https://jvn.jp/en/jp/JVN13218253/index.html; https://support.cybozu.com/ja-jp/article/9441
CVE: CVE-2016-4908
Published: 2017-06-09
Description: Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94966; http://www.securityfocus.com/bid/97912; https://jvn.jp/en/jp/JVN14631222/index.html
CVE: CVE-2016-4909
Published: 2017-06-09
Description: Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94973; http://www.securityfocus.com/bid/97911; https://jvn.jp/en/jp/JVN15222211/index.html
CVE: CVE-2016-4910
Published: 2017-06-09
Description: Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94966; https://jvn.jp/en/jp/JVN14631222/index.html; https://support.cybozu.com/ja-jp/article/9461