deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2045
Published: 2015-03-12
Description: The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html
CVE: CVE-2015-2150
Published: 2015-03-12
Description: Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=af6fc858a35b90e89ea7a7ee58e66628c55c776b; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
CVE: CVE-2015-2151
Published: 2015-03-12
Description: The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html
CVE: CVE-2015-2208
Published: 2015-03-12
Description: The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/130685/PHPMoAdmin-1.1.2-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2015/Mar/19; http://www.exploit-db.com/exploits/36251
CVE: CVE-2015-2241
Published: 2015-03-12
Description: Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2015:109; http://www.securityfocus.com/bid/73095; https://code.djangoproject.com/ticket/24461
CVE: CVE-2015-2285
Published: 2015-03-12
Description: The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.
CVSS Score: 7.2 (HIGH)
CWE: CWE-19
References: http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Mar/7; http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
CVE: CVE-2015-2237
Published: 2015-03-12
Description: Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130696/Betster-1.0.4-SQL-Injection-Authentication-Bypass.html; http://www.securityfocus.com/archive/1/534816/100/0/threaded; https://www.exploit-db.com/exploits/36306/
CVE: CVE-2015-2275
Published: 2015-03-12
Description: Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130766/Community-Gallery-2.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/65; http://www.exploit-db.com/exploits/36368
CVE: CVE-2014-6144
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager (RQM) 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698361; http://www.securitytracker.com/id/1031885; http://www-01.ibm.com/support/docview.wss?uid=swg21698361
CVE: CVE-2014-6214
Published: 2015-03-13
Description: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI34987; http://www-01.ibm.com/support/docview.wss?uid=swg21697213; http://www.securitytracker.com/id/1031880
CVE: CVE-2015-0122
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0123.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698253; http://www.securityfocus.com/bid/73093; http://www.securitytracker.com/id/1031884
CVE: CVE-2015-0123
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698253; http://www.securityfocus.com/bid/73101; http://www.securitytracker.com/id/1031884
CVE: CVE-2015-0129
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager (RQM) 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21696856; http://www.securitytracker.com/id/1031886; http://www-01.ibm.com/support/docview.wss?uid=swg21696856
CVE: CVE-2015-0133
Published: 2015-03-13
Description: IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52499; http://www-01.ibm.com/support/docview.wss?uid=swg21696242; http://www.securitytracker.com/id/1031881
CVE: CVE-2015-0139
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI33329; http://www-01.ibm.com/support/docview.wss?uid=swg21697213; http://www.securitytracker.com/id/1031880
CVE: CVE-2015-0177
Published: 2015-03-13
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI35228; http://www-01.ibm.com/support/docview.wss?uid=swg21697213; http://www.securitytracker.com/id/1031880
CVE: CVE-2015-0652
Published: 2015-03-13
Description: The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description, aka Bug IDs CSCus96593 and CSCun73192.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs; http://www.securitytracker.com/id/1031910; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs
CVE: CVE-2015-0653
Published: 2015-03-13
Description: The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs; http://www.securitytracker.com/id/1031910; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs
CVE: CVE-2015-0654
Published: 2015-03-13
Description: Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-ips; http://www.securitytracker.com/id/1031908; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-ips
CVE: CVE-2015-2264
Published: 2015-03-13
Description: Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory.
CVSS Score: 6.9 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/794095; http://www.kb.cert.org/vuls/id/794095
CVE: CVE-2015-1782
Published: 2015-03-13
Description: The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151943.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152362.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153933.html
CVE: CVE-2015-2091
Published: 2015-03-13
Description: The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://issues.outoforder.cc/view.php?id=93; http://www.debian.org/security/2015/dsa-3177; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663
CVE: CVE-2015-0332
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0333, CVE-2015-0335, and CVE-2015-0339.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0333
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0335, and CVE-2015-0339.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0334
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0335
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0339.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0336
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0337
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0338
Published: 2015-03-13
Description: Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0339
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0335.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0340
Published: 2015-03-13
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0341
Published: 2015-03-13
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0342.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2015-0342
Published: 2015-03-13
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0341.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00016.html
CVE: CVE-2014-5409
Published: 2015-03-14
Description: The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-343
References: http://libraries.ge.com/download?fileid=[PII_REDACTED]01&entity_id=[PII_REDACTED]1&sid=101; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-041-02.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-041-02
CVE: CVE-2014-7884
Published: 2015-03-14
Description: Multiple unspecified vulnerabilities in HP ArcSight Logger before 6.0P1 have unknown impact and remote authenticated attack vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/868948; http://www.securitytracker.com/id/1031921; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04562193
CVE: CVE-2014-7885
Published: 2015-03-14
Description: Multiple unspecified vulnerabilities in HP ArcSight Enterprise Security Manager (ESM) before 6.8c have unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/868948; http://www.securitytracker.com/id/1031921; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04562193
CVE: CVE-2014-9206
Published: 2015-03-14
Description: Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6 and earlier for Schneider Electric Invensys SRD Control Valve Positioner devices 960 and 991 allows local users to gain privileges via a malformed DLL file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://download.schneider-electric.com/files?p_File_Id=745435959&p_File_Name=SEVD-2015-050-01.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-055-03; http://download.schneider-electric.com/files?p_File_Id=745435959&p_File_Name=SEVD-2015-050-01.pdf
CVE: CVE-2014-9207
Published: 2015-03-14
Description: Untrusted search path vulnerability in CmnView.exe in CIMON CmnView 2.14.0.1 and 3.x before UltimateAccess 3.02 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-069-01
CVE: CVE-2015-0660
Published: 2015-03-14
Description: Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0660; http://www.securitytracker.com/id/1031924; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0660
CVE: CVE-2015-0978
Published: 2015-03-14
Description: Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.  NOTE: this may overlap CVE-2015-2264.
CVSS Score: 6.9 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A; https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A
CVE: CVE-2015-0979
Published: 2015-03-14
Description: Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE: CVE-2015-0980
Published: 2015-03-14
Description: Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE: CVE-2015-0981
Published: 2015-03-14
Description: The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03; https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE: CVE-2015-0982
Published: 2015-03-14
Description: Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://download.schneider-electric.com/files?p_File_Id=755516404&p_File_Name=SEVD-2015-065-01+Pelco+DS-NVs+Video+Mgmt+SW.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01; http://download.schneider-electric.com/files?p_File_Id=755516404&p_File_Name=SEVD-2015-065-01+Pelco+DS-NVs+Video+Mgmt+SW.pdf
CVE: CVE-2015-2107
Published: 2015-03-14
Description: HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04588084; http://www.securitytracker.com/id/1031870; http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04588084