deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1626
Published: 2016-02-14
Description: The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html
CVE: CVE-2016-1627
Published: 2016-02-14
Description: The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html
CVE: CVE-2015-2005
Published: 2016-02-15
Description: IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967654; http://www-01.ibm.com/support/docview.wss?uid=swg21967654
CVE: CVE-2015-2008
Published: 2016-02-15
Description: IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967632; http://www-01.ibm.com/support/docview.wss?uid=swg21967632
CVE: CVE-2015-3197
Published: 2016-02-15
Description: ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
CVE: CVE-2015-4956
Published: 2016-02-15
Description: The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967649; http://www-01.ibm.com/support/docview.wss?uid=swg21967649
CVE: CVE-2015-4957
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967631; http://www-01.ibm.com/support/docview.wss?uid=swg21967631
CVE: CVE-2015-4991
Published: 2016-02-15
Description: IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartext data in memory dumps, which allows local users to obtain sensitive information by reading a dump file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI46224; http://www-01.ibm.com/support/docview.wss?uid=swg21975663; http://www-01.ibm.com/support/docview.wss?uid=swg1PI46224
CVE: CVE-2015-5010
Published: 2016-02-15
Description: IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV80694; http://www-01.ibm.com/support/docview.wss?uid=swg1IV80728; http://www-01.ibm.com/support/docview.wss?uid=swg21970508
CVE: CVE-2015-5012
Published: 2016-02-15
Description: The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV78768; http://www-01.ibm.com/support/docview.wss?uid=swg1IV78780; http://www-01.ibm.com/support/docview.wss?uid=swg21971422
CVE: CVE-2015-5042
Published: 2016-02-15
Description: IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973592; http://www-01.ibm.com/support/docview.wss?uid=swg21973592
CVE: CVE-2015-5050
Published: 2016-02-15
Description: Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973592; http://www-01.ibm.com/support/docview.wss?uid=swg21973592
CVE: CVE-2015-7398
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973592; http://www-01.ibm.com/support/docview.wss?uid=swg21973592
CVE: CVE-2015-7408
Published: 2016-02-15
Description: The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT13609; http://www-01.ibm.com/support/docview.wss?uid=swg21975957; http://www-01.ibm.com/support/docview.wss?uid=swg1IT13609
CVE: CVE-2015-7444
Published: 2016-02-15
Description: The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54563; http://www-01.ibm.com/support/docview.wss?uid=swg24041614; http://www-01.ibm.com/support/docview.wss?uid=swg1JR54563
CVE: CVE-2015-7472
Published: 2016-02-15
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI53426; http://www-01.ibm.com/support/docview.wss?uid=swg21972736; http://www.securitytracker.com/id/1035324
CVE: CVE-2015-7492
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in Reference Data Management (RDM) in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21974981; http://www-01.ibm.com/support/docview.wss?uid=swg21974981
CVE: CVE-2015-8531
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV80692; http://www-01.ibm.com/support/docview.wss?uid=swg21974651; http://www-01.ibm.com/support/docview.wss?uid=swg1IV80692
CVE: CVE-2015-8795
Published: 2016-02-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://issues.apache.org/jira/browse/SOLR-7346; https://issues.apache.org/jira/browse/SOLR-7346
CVE: CVE-2015-8796
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/85205; https://issues.apache.org/jira/browse/SOLR-7920; http://www.securityfocus.com/bid/85205
CVE: CVE-2015-8797
Published: 2016-02-15
Description: Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975544; https://issues.apache.org/jira/browse/SOLR-7949; http://www-01.ibm.com/support/docview.wss?uid=swg21975544
CVE: CVE-2016-0701
Published: 2016-02-15
Description: The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html
CVE: CVE-2016-2231
Published: 2016-02-15
Description: The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size, which allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: https://debihiga.wordpress.com/sa-whip/; https://debihiga.wordpress.com/sa-whip/
CVE: CVE-2016-2314
Published: 2016-02-15
Description: GlobespanVirata ftpd 1.0, as used on Huawei SmartAX MT882 devices V200R002B022 Arg, allows remote authenticated users to cause a denial of service (device outage) by using the FTP MKD command to create a directory with a long name, and then using certain other commands.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: https://debihiga.wordpress.com/sa-ftp/; https://debihiga.wordpress.com/sa-ftp/
CVE: CVE-2016-0742
Published: 2016-02-15
Description: The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html; http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2016-0746
Published: 2016-02-15
Description: Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html; http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2016-0747
Published: 2016-02-15
Description: The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html; http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2016-0231
Published: 2016-02-15
Description: IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI56757; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56758; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56759
CVE: CVE-2016-0232
Published: 2016-02-15
Description: IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading README files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI56757; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56758; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56759
CVE: CVE-2016-1321
Published: 2016-02-15
Description: Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160212-usc; http://www.securitytracker.com/id/1035014; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160212-usc
CVE: CVE-2016-1330
Published: 2016-02-15
Description: Cisco IOS 15.2(4)E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service (device reload) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuy27746.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-ie2000; http://www.securitytracker.com/id/1035013; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-ie2000
CVE: CVE-2016-1331
Published: 2016-02-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 11.5(0.99833.5) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy10766.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-er; http://www.securitytracker.com/id/1035012; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-er
CVE: CVE-2015-7576
Published: 2016-02-16
Description: The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
CVSS Score: 3.7 (LOW)
CWE: CWE-254
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
CVE: CVE-2015-7577
Published: 2016-02-16
Description: activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
CVE: CVE-2015-7578
Published: 2016-02-16
Description: Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178046.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178064.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html
CVE: CVE-2015-7579
Published: 2016-02-16
Description: Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178046.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178064.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html
CVE: CVE-2015-7580
Published: 2016-02-16
Description: Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
CVE: CVE-2015-7581
Published: 2016-02-16
Description: actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
CVE: CVE-2016-0751
Published: 2016-02-16
Description: actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
CVE: CVE-2016-0752
Published: 2016-02-16
Description: Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
CVE: CVE-2016-0753
Published: 2016-02-16
Description: Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
CVSS Score: 5.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
CVE: CVE-2016-2386
Published: 2016-02-16
Description: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/May/56; https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
CVE: CVE-2016-2387
Published: 2016-02-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137045/SAP-NetWeaver-AS-JAVA-7.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/May/39; https://erpscan.io/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability/