deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3664
Published: 2016-05-23
Description: Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/137020/Trend-Micro-Mobile-Security-Man-In-The-Middle.html; http://www.info-sec.ca/advisories/Trend-Micro-Mobile-Security.html; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1114151.aspx
CVE: CVE-2016-3958
Published: 2016-05-23
Description: Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/04/05/1; http://www.openwall.com/lists/oss-security/2016/04/05/2; https://github.com/golang/go/issues/14959
CVE: CVE-2016-3959
Published: 2016-05-23
Description: The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182526.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183106.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183137.html
CVE: CVE-2016-4001
Published: 2016-05-23
Description: Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3a15cc0e1ee7168db0782133d2607a6bfa422d66; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
CVE: CVE-2016-4037
Published: 2016-05-23
Description: The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-400
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1ae3f2f178087711f9591350abad133525ba93f2; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
CVE: CVE-2016-4049
Published: 2016-05-23
Description: The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00062.html; http://rhn.redhat.com/errata/RHSA-2017-0794.html; http://www.debian.org/security/2016/dsa-3654
CVE: CVE-2016-4087
Published: 2016-05-23
Description: Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch is enabled, allows remote attackers to cause a denial of service or execute arbitrary code via crafted DNS packets.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160427-01-dns-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160427-01-dns-en
CVE: CVE-2016-4576
Published: 2016-05-23
Description: Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in the Huawei IPS Module, NGFW Module, NIP6300, NIP6600, Secospace USG6300, USG6500, USG6600, USG9500, and AntiDDoS8000 devices with software before V500R001C20SPC100 allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet, related to "illegitimate parameters."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160511-01-aspf-en; http://www.securityfocus.com/bid/90530; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160511-01-aspf-en
CVE: CVE-2016-4577
Published: 2016-05-23
Description: Buffer overflow in the Smart DNS functionality in the Huawei NGFW Module and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls with software before V500R001C20SPC100 allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet, related to "illegitimate parameters."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160511-01-dns-en; http://www.securityfocus.com/bid/90532; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160511-01-dns-en
CVE: CVE-2016-4782
Published: 2016-05-23
Description: Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/len_6421; https://support.lenovo.com/us/en/product_security/len_6421
CVE: CVE-2016-4783
Published: 2016-05-23
Description: Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98_ww on Android before 4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.lenovo.com/us/en/product_security/len_6421; https://support.lenovo.com/us/en/product_security/len_6421
CVE: CVE-2016-0264
Published: 2016-05-24
Description: Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
CVE: CVE-2016-1380
Published: 2016-05-25
Description: Cisco AsyncOS 8.0 before 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request, aka Bug ID CSCuo12171.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa1; http://www.securitytracker.com/id/1035908; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa1
CVE: CVE-2016-1381
Published: 2016-05-25
Description: Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an HTTP file-range request for cached content, aka Bug ID CSCuw97270.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa2; http://www.securitytracker.com/id/1035909; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa2
CVE: CVE-2016-1382
Published: 2016-05-25
Description: Cisco AsyncOS before 8.5.3-069 and 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, which allows remote attackers to cause a denial of service (proxy-process reload) via a crafted request, aka Bug ID CSCuu02529.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa3; http://www.securitytracker.com/id/1035910; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa3
CVE: CVE-2016-1383
Published: 2016-05-25
Description: Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an unspecified HTTP status code, aka Bug ID CSCur28305.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa4; http://www.securitytracker.com/id/1035911; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160518-wsa4
CVE: CVE-2016-1400
Published: 2016-05-25
Description: Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160516-vcs; http://www.securitytracker.com/id/1035899; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160516-vcs
CVE: CVE-2016-1406
Published: 2016-05-25
Description: The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm; http://www.securitytracker.com/id/1035948; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm
CVE: CVE-2016-1407
Published: 2016-05-25
Description: Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries, which allows remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports, aka Bug ID CSCux95576.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160519-ios-xr; http://www.securitytracker.com/id/1035934; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160519-ios-xr
CVE: CVE-2014-3672
Published: 2016-05-25
Description: The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/05/24/5; http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035945
CVE: CVE-2015-8853
Published: 2016-05-25
Description: The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html; http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5; http://www.openwall.com/lists/oss-security/2016/04/20/5
CVE: CVE-2016-1886
Published: 2016-05-25
Description: Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://cturt.github.io/SETFKEY.html; http://www.securityfocus.com/bid/90734; http://www.securitytracker.com/id/1035905
CVE: CVE-2016-1887
Published: 2016-05-25
Description: Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service (memory overwrite and kernel panic) or gain privileges via a negative buflen argument, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://cturt.github.io/sendmsg.html; http://www.securitytracker.com/id/1035906; https://security.FreeBSD.org/advisories/FreeBSD-SA-16:19.sendmsg.asc
CVE: CVE-2016-4020
Published: 2016-05-25
Description: The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
CVSS Score: 6.5 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0; http://www.securityfocus.com/bid/86067; http://www.ubuntu.com/usn/USN-2974-1
CVE: CVE-2016-4575
Published: 2016-05-25
Description: Cross-site scripting (XSS) vulnerability in the email APP in Huawei PLK smartphones with software AL10C00 before AL10C00B211 and AL10C92 before AL10C92B211; ATH smartphones with software AL00C00 before AL00C00B361, CL00C92 before CL00C92B361, TL00HC01 before TL00HC01B361, and UL00C00 before UL00C00B361; CherryPlus smartphones with software TL00C00 before TL00C00B553, UL00C00 before UL00C00B553, and TL00MC01 before TL00MC01B553; and RIO smartphones with software AL00C00 before AL00C00B360 allows remote attackers to inject arbitrary web script or HTML via an email message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160507-01-emailapp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160507-01-emailapp-en
CVE: CVE-2016-2784
Published: 2016-05-26
Description: CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html; http://seclists.org/fulldisclosure/2016/May/15; http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/
CVE: CVE-2016-4021
Published: 2016-05-26
Description: The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption) via crafted input, as demonstrated by the \xa3\x03 string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183750.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184617.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184689.html
CVE: CVE-2016-4786
Published: 2016-05-26
Description: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40206; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4787
Published: 2016-05-26
Description: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
CVSS Score: 10.0 (CRITICAL)
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40207; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4788
Published: 2016-05-26
Description: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40208; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4789
Published: 2016-05-26
Description: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40209; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4790
Published: 2016-05-26
Description: Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40211; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4791
Published: 2016-05-26
Description: The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.
CVSS Score: 8.6 (HIGH)
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40210; http://www.securitytracker.com/id/1035932
CVE: CVE-2016-4792
Published: 2016-05-26
Description: Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securitytracker.com/id/1035932; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40212; http://www.securitytracker.com/id/1035932
CVE: CVE-2015-7360
Published: 2016-05-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortisandbox-webui; http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt; http://packetstormsecurity.com/files/132930/FortiSandbox-3000D-2.02-build0042-Cross-Site-Scripting.html
CVE: CVE-2016-1385
Published: 2016-05-26
Description: The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, memory consumption, or device reload) by leveraging (1) administrative access or (2) Clientless SSL VPN access to provide a crafted XML document, aka Bug ID CSCut14209.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-xml; http://www.securitytracker.com/id/1035976; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-xml
CVE: CVE-2016-0718
Published: 2016-05-26
Description: Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html
CVE: CVE-2016-3680
Published: 2016-05-26
Description: Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03020.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en
CVE: CVE-2016-3681
Published: 2016-05-26
Description: Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03021.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en
CVE: CVE-2016-1379
Published: 2016-05-28
Description: Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted (1) LAN-to-LAN or (2) Remote Access VPN tunnel packets, aka Bug ID CSCuv70576.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-vpn; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-vpn
CVE: CVE-2016-1410
Published: 2016-05-28
Description: Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting, aka Bug ID CSCux84312.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160526-wmc; http://www.securityfocus.com/bid/90908; http://www.securitytracker.com/id/1035977
CVE: CVE-2016-1413
Published: 2016-05-28
Description: The web interface in Cisco Firepower Management Center 5.4.0 through 6.0.0.1 allows remote authenticated users to modify pages by placing crafted code in a parameter value, aka Bug ID CSCuy76517.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160527-fmc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160527-fmc
CVE: CVE-2016-1404
Published: 2016-05-29
Description: Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic to an Autosupport server and leveraging knowledge of this key from another installation, aka Bug ID CSCur85504.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160524-ucs-inv; http://www.securitytracker.com/id/1035957; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160524-ucs-inv