deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0088
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/72898; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0089
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72896; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0090
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/72904; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0091
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/72905; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0092
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/72906; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0093
Published: 2015-03-11
Description: Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0092.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/72907; http://www.securitytracker.com/id/1031889; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
CVE: CVE-2015-0094
Published: 2015-03-11
Description: The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1031897; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-023; http://www.securitytracker.com/id/1031897
CVE: CVE-2015-0095
Published: 2015-03-11
Description: The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service (NULL pointer dereference and blue screen), or obtain sensitive information from kernel memory and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/72936; http://www.securitytracker.com/id/1031897; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-023
CVE: CVE-2015-0096
Published: 2015-03-11
Description: Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/72894; http://www.securitytracker.com/id/1031890; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-020
CVE: CVE-2015-0097
Published: 2015-03-11
Description: Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Word Local Zone Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-19
References: http://www.securitytracker.com/id/1031896; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022; https://www.exploit-db.com/exploits/37657/
CVE: CVE-2015-0099
Published: 2015-03-11
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72925; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-0100
Published: 2015-03-11
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/72926; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1622
Published: 2015-03-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72927; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1623
Published: 2015-03-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1626.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72928; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1624
Published: 2015-03-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72929; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1625
Published: 2015-03-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1634.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72923; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1626
Published: 2015-03-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1623.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72930; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1627
Published: 2015-03-11
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72932; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1628
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031900; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026; http://www.securitytracker.com/id/1031900
CVE: CVE-2015-1629
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031900; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026; http://www.securitytracker.com/id/1031900
CVE: CVE-2015-1630
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031900; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026; http://www.securitytracker.com/id/1031900
CVE: CVE-2015-1631
Published: 2015-03-11
Description: Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1031900; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026; http://www.securitytracker.com/id/1031900
CVE: CVE-2015-1632
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031900; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026; http://www.securitytracker.com/id/1031900
CVE: CVE-2015-1633
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031895; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022; http://www.securitytracker.com/id/1031895
CVE: CVE-2015-1634
Published: 2015-03-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1625.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72931; http://www.securitytracker.com/id/1031888; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
CVE: CVE-2015-1636
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securitytracker.com/id/1031895; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022; http://www.securitytracker.com/id/1031895
CVE: CVE-2010-5322
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/68756; http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/89
CVE: CVE-2014-9017
Published: 2015-03-11
Description: Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130723/OpenKM-Stored-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/48; http://seclists.org/fulldisclosure/2015/Mar/51
CVE: CVE-2015-1026
Published: 2015-03-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534833/100/0/threaded; http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html
CVE: CVE-2015-1875
Published: 2015-03-11
Description: SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130698/Elastix-2.5.0-SQL-Injection.html; https://www.exploit-db.com/exploits/36305/; http://packetstormsecurity.com/files/130698/Elastix-2.5.0-SQL-Injection.html
CVE: CVE-2015-2182
Published: 2015-03-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php.  NOTE: The search parameter vector is already covered by CVE-2010-5322.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/68756; http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/89
CVE: CVE-2015-0521
Published: 2015-03-12
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html; http://seclists.org/bugtraq/2015/Mar/47; http://www.securitytracker.com/id/1031912
CVE: CVE-2015-0522
Published: 2015-03-12
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote attackers to inject arbitrary web script or HTML via vectors related to the email address parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html; http://seclists.org/bugtraq/2015/Mar/47; http://www.securitytracker.com/id/1031912
CVE: CVE-2015-0523
Published: 2015-03-12
Description: EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allow remote attackers to cause an Administration Server denial of service via an invalid MIME e-mail message with a multipart/* Content-Type header.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html; http://seclists.org/bugtraq/2015/Mar/47; http://www.securitytracker.com/id/1031912
CVE: CVE-2015-0524
Published: 2015-03-12
Description: SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html; http://seclists.org/bugtraq/2015/Mar/40; http://seclists.org/fulldisclosure/2015/Mar/119
CVE: CVE-2015-0525
Published: 2015-03-12
Description: The Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html; http://seclists.org/bugtraq/2015/Mar/40; http://seclists.org/fulldisclosure/2015/Mar/118
CVE: CVE-2015-1061
Published: 2015-03-12
Description: IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.html
CVE: CVE-2015-1062
Published: 2015-03-12
Description: MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00001.html; http://www.securitytracker.com/id/1031864
CVE: CVE-2015-1063
Published: 2015-03-12
Description: CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
CVSS Score: 7.8 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://www.securitytracker.com/id/1031864; https://support.apple.com/HT204423
CVE: CVE-2015-1064
Published: 2015-03-12
Description: Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://www.securitytracker.com/id/1031864; https://support.apple.com/HT204423
CVE: CVE-2015-1065
Published: 2015-03-12
Description: Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.html; http://www.securityfocus.com/bid/73007
CVE: CVE-2015-1066
Published: 2015-03-12
Description: Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.html; http://www.securitytracker.com/id/1031869; https://support.apple.com/HT204413
CVE: CVE-2015-2044
Published: 2015-03-12
Description: The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html