deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0061
Published: 2015-02-11
Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for TIFF images, which allows remote attackers to obtain sensitive information from process memory via a crafted image file, aka "TIFF Processing Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72456; http://www.securitytracker.com/id/1031725; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-016
CVE: CVE-2015-0062
Published: 2015-02-11
Description: Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a process that uses the SeAssignPrimaryTokenPrivilege privilege, aka "Windows Create Process Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/62840; http://www.securityfocus.com/bid/72458; http://www.securitytracker.com/id/1031724
CVE: CVE-2015-0063
Published: 2015-02-11
Description: Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/62808; http://www.securityfocus.com/bid/72460; http://www.securitytracker.com/id/1031720
CVE: CVE-2015-0064
Published: 2015-02-11
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Office Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/62808; http://www.securityfocus.com/bid/72463; http://www.securitytracker.com/id/1031720
CVE: CVE-2015-0065
Published: 2015-02-11
Description: Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "OneTableDocumentStream Remote Code Execution Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/62808; http://www.securityfocus.com/bid/72465; http://www.securitytracker.com/id/1031720
CVE: CVE-2015-0066
Published: 2015-02-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0040.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72422; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0067
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72423; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0068
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0052.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72424; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0069
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72454; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0070
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/72480; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0071
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/72455; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-1172
Published: 2015-02-11
Description: Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/130282/WordPress-Holding-Pattern-0.6-Shell-Upload.html; http://www.securityfocus.com/bid/72546; https://wpvulndb.com/vulnerabilities/7784
CVE: CVE-2015-1518
Published: 2015-02-11
Description: SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130322/Radexscript-CMS-2.2.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Feb/39; http://www.exploit-db.com/exploits/36023
CVE: CVE-2015-1575
Published: 2015-02-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the (1) c, (2) i, (3) l, or (4) p parameter to index.php; the (5) a or (6) b parameter to u5admin/cookie.php; the name parameter to (7) copy.php or (8) delete.php in u5admin/; the (9) f or (10) typ parameter to u5admin/deletefile.php; the (11) n parameter to u5admin/done.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130292/u5CMS-3.9.3-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/36029; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5223.php
CVE: CVE-2015-1576
Published: 2015-02-11
Description: Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130326/u5CMS-3.9.3-SQL-Injection.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php; http://packetstormsecurity.com/files/130326/u5CMS-3.9.3-SQL-Injection.html
CVE: CVE-2015-1577
Published: 2015-02-11
Description: Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/130325/u5CMS-3.9.3-Arbitrary-File-Deletion.html; http://www.exploit-db.com/exploits/36026; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php
CVE: CVE-2015-1578
Published: 2015-02-11
Description: Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/130317/u5CMS-3.9.3-Open-Redirect.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php; http://packetstormsecurity.com/files/130317/u5CMS-3.9.3-Open-Redirect.html
CVE: CVE-2015-1579
Published: 2015-02-11
Description: Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.  NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/36039; https://wpvulndb.com/vulnerabilities/7540; http://www.exploit-db.com/exploits/36039
CVE: CVE-2015-1580
Published: 2015-02-11
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) source or (3) redir parameter in an add action in the redirection-page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130314/WordPress-Redirection-Page-1.2-CSRF-XSS.html; http://packetstormsecurity.com/files/130314/WordPress-Redirection-Page-1.2-CSRF-XSS.html
CVE: CVE-2015-1581
Published: 2015-02-11
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130316/WordPress-Mobile-Domain-1.5.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/130316/WordPress-Mobile-Domain-1.5.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2015-1582
Published: 2015-02-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130318/WordPress-Spider-Facebook-1.0.10-Cross-Site-Scripting.html; https://wordpress.org/plugins/spider-facebook/changelog/; http://packetstormsecurity.com/files/130318/WordPress-Spider-Facebook-1.0.10-Cross-Site-Scripting.html
CVE: CVE-2014-2147
Published: 2015-02-12
Description: The web interface in Cisco Prime Infrastructure 2.1 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuj42444.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2147; http://tools.cisco.com/security/center/viewAlert.x?alertId=37419; http://www.securityfocus.com/bid/72551
CVE: CVE-2014-2152
Published: 2015-02-12
Description: Cross-site request forgery (CSRF) vulnerability in the INSERT page in Cisco Prime Infrastructure (PI) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2152; http://www.securityfocus.com/bid/72558; http://www.securitytracker.com/id/1031715
CVE: CVE-2014-2153
Published: 2015-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2153; http://www.securityfocus.com/bid/72555; http://www.securitytracker.com/id/1031715
CVE: CVE-2014-3365
Published: 2015-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Prime Security Manager (PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the (1) Dashboard or (2) Configure Realm page, aka Bug ID CSCuo94808.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365; http://tools.cisco.com/security/center/viewAlert.x?alertId=37418; http://www.securitytracker.com/id/1031716
CVE: CVE-2015-0580
Published: 2015-02-12
Description: Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150211-csacs; http://www.securityfocus.com/bid/72576; http://www.securitytracker.com/id/1031740
CVE: CVE-2015-0592
Published: 2015-02-12
Description: The Zone-Based Firewall implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers incorrect kernel-timer handling, aka Bug ID CSCuh25672.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0592; http://tools.cisco.com/security/center/viewAlert.x?alertId=37416; http://www.securitytracker.com/id/1031713
CVE: CVE-2015-0606
Published: 2015-02-12
Description: The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0606; http://www.securityfocus.com/bid/72550; http://www.securitytracker.com/id/1031717
CVE: CVE-2015-0608
Published: 2015-02-12
Description: Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCul48736.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0608; http://tools.cisco.com/security/center/viewAlert.x?alertId=37421; http://www.securityfocus.com/bid/72566
CVE: CVE-2015-0610
Published: 2015-02-12
Description: Race condition in the object-group ACL feature in Cisco IOS 15.5(2)T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCun21071.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0610; http://tools.cisco.com/security/center/viewAlert.x?alertId=37423; http://www.securityfocus.com/bid/72565
CVE: CVE-2015-0611
Published: 2015-02-12
Description: The administrative web-management portal in Cisco IX 8 (.0.1) and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery authentication, aka Bug ID CSCus74174.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0611; http://tools.cisco.com/security/center/viewAlert.x?alertId=37430; http://www.securityfocus.com/bid/72568
CVE: CVE-2015-0619
Published: 2015-02-12
Description: Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and SSL outage) via multiple crafted HTTP requests, aka Bug ID CSCue05458.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0619; http://www.securityfocus.com/bid/72579; http://www.securitytracker.com/id/1031745
CVE: CVE-2014-8110
Published: 2015-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2014-8110-announcement.txt; http://seclists.org/oss-sec/2015/q1/427; http://secunia.com/advisories/62649
CVE: CVE-2014-9512
Published: 2015-02-12
Description: rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2015-02/msg00041.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00095.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00112.html
CVE: CVE-2015-0227
Published: 2015-02-12
Description: Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0773.html; http://rhn.redhat.com/errata/RHSA-2015-0846.html; http://rhn.redhat.com/errata/RHSA-2015-0847.html
CVE: CVE-2015-1345
Published: 2015-02-12
Description: The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563; http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2; http://lists.opensuse.org/opensuse-updates/2015-02/msg00037.html
CVE: CVE-2015-1471
Published: 2015-02-12
Description: SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pastebin.com/ip2gGYuS; http://seclists.org/fulldisclosure/2015/Feb/18; http://seclists.org/oss-sec/2015/q1/402
CVE: CVE-2015-1545
Published: 2015-02-12
Description: The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2015-1546
Published: 2015-02-12
Description: Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html; http://secunia.com/advisories/62787
CVE: CVE-2014-4771
Published: 2015-02-13
Description: IBM WebSphere MQ 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1 allows remote authenticated users to cause a denial of service (queue-slot exhaustion) by leveraging PCF query privileges for a crafted query.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV69190; http://www-01.ibm.com/support/docview.wss?uid=swg21696120; https://exchange.xforce.ibmcloud.com/vulnerabilities/94842
CVE: CVE-2014-4781
Published: 2015-02-13
Description: The alert module in IBM InfoSphere BigInsights 2.1.2 and 3.x before 3.0.0.2 allows remote attackers to obtain sensitive Alert management-services API information via a network-tracing attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693053; https://exchange.xforce.ibmcloud.com/vulnerabilities/95028; http://www-01.ibm.com/support/docview.wss?uid=swg21693053
CVE: CVE-2014-4803
Published: 2015-02-13
Description: CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspecified parameter.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695925; https://exchange.xforce.ibmcloud.com/vulnerabilities/95305; http://www-01.ibm.com/support/docview.wss?uid=swg21695925
CVE: CVE-2014-4813
Published: 2015-02-13
Description: Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6, 5.5.0.0 through 5.5.4.3, 6.1.0.0 through 6.1.5.6, 6.2 before 6.2.5.4, 6.3 before 6.3.2.3, 6.4 before 6.4.2.1, and 7.1 before 7.1.1 on UNIX and Linux allows local users to obtain root privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT04140; http://www-01.ibm.com/support/docview.wss?uid=swg21695652; https://exchange.xforce.ibmcloud.com/vulnerabilities/95389