deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1983
Published: 2015-10-04
Description: Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21964316; http://www-01.ibm.com/support/docview.wss?uid=swg21964316
CVE: CVE-2015-1988
Published: 2015-10-04
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967532; http://www-01.ibm.com/support/docview.wss?uid=swg21967532
CVE: CVE-2015-2011
Published: 2015-10-04
Description: The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965817; http://www-01.ibm.com/support/docview.wss?uid=swg21965817
CVE: CVE-2015-2016
Published: 2015-10-04
Description: Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965813; http://www-01.ibm.com/support/docview.wss?uid=swg21965813
CVE: CVE-2015-2025
Published: 2015-10-04
Description: IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2026
Published: 2015-10-04
Description: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2027
Published: 2015-10-04
Description: IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2028
Published: 2015-10-04
Description: CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2029
Published: 2015-10-04
Description: Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2030
Published: 2015-10-04
Description: IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-2031
Published: 2015-10-04
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105; http://www-01.ibm.com/support/docview.wss?uid=swg21966044
CVE: CVE-2015-4930
Published: 2015-10-04
Description: IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.
CVSS Score: 9.0 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965813; http://www.securityfocus.com/bid/76695; http://www-01.ibm.com/support/docview.wss?uid=swg21965813
CVE: CVE-2015-5687
Published: 2015-10-05
Description: system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2015/Aug/76; http://seclists.org/fulldisclosure/2015/Aug/83; https://github.com/anchorcms/anchor-cms/pull/904
CVE: CVE-2015-7392
Published: 2015-10-05
Description: Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSON_Parse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133781/freeswitch-Heap-Overflow.html; http://www.securityfocus.com/archive/1/536569/100/0/threaded; https://freeswitch.org/stash/projects/FS/repos/freeswitch/commits/cf8925
CVE: CVE-2015-7684
Published: 2015-10-05
Description: Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.
CVSS Score: 9.0 (HIGH)
References: http://seclists.org/fulldisclosure/2015/Feb/71; http://www.glpi-project.org/spip.php?page=annonce&id_breve=338; https://forge.glpi-project.org/issues/5217
CVE: CVE-2015-7685
Published: 2015-10-05
Description: GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2015/Feb/71; http://www.glpi-project.org/spip.php?page=annonce&id_breve=338; https://forge.glpi-project.org/issues/5218
CVE: CVE-2015-7322
Published: 2015-10-05
Description: The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033685; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40053; https://profundis-labs.com/advisories/CVE-2015-7322.txt
CVE: CVE-2015-7323
Published: 2015-10-05
Description: The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2015/Sep/98; http://www.securitytracker.com/id/1033684; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40054
CVE: CVE-2015-7707
Published: 2015-10-05
Description: Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt; http://packetstormsecurity.com/files/133559/Openfire-3.10.2-Privilege-Escalation.html; https://igniterealtime.org/issues/browse/OF-941
CVE: CVE-2015-7708
Published: 2015-10-05
Description: Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133712/4images-1.7.11-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/95; http://packetstormsecurity.com/files/133712/4images-1.7.11-Cross-Site-Scripting.html
CVE: CVE-2015-7709
Published: 2015-10-05
Description: The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec; https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/37600/
CVE: CVE-2014-9297
Published: 2015-10-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9750, CVE-2014-9751.  Reason: this ID was intended for one issue, but was associated with two issues.  Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-9298
Published: 2015-10-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9750, CVE-2014-9751.  Reason: this ID was intended for one issue, but was associated with two issues.  Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-9750
Published: 2015-10-06
Description: ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.ntp.org/show_bug.cgi?id=2671; http://rhn.redhat.com/errata/RHSA-2015-1459.html; http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne
CVE: CVE-2014-9751
Published: 2015-10-06
Description: The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.ntp.org/show_bug.cgi?id=2672; http://rhn.redhat.com/errata/RHSA-2015-1459.html; http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne
CVE: CVE-2015-0987
Published: 2015-10-06
Description: Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE: CVE-2015-0988
Published: 2015-10-06
Description: Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE: CVE-2015-1015
Published: 2015-10-06
Description: Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE: CVE-2015-3938
Published: 2015-10-06
Description: The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-146-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-146-01
CVE: CVE-2015-4939
Published: 2015-10-06
Description: Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21966754; http://www-01.ibm.com/support/docview.wss?uid=swg21966754
CVE: CVE-2015-4944
Published: 2015-10-06
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963973; http://www-01.ibm.com/support/docview.wss?uid=swg21963973
CVE: CVE-2015-4964
Published: 2015-10-06
Description: IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTH_TOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21964623; http://www-01.ibm.com/support/docview.wss?uid=swg21964623
CVE: CVE-2015-4965
Published: 2015-10-06
Description: maximouiweb/webmodule/webclient/utility/merlin.jsp in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to obtain sensitive information by reading a (1) backup or (2) debug application file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21966194; http://www-01.ibm.com/support/docview.wss?uid=swg21966194
CVE: CVE-2015-4967
Published: 2015-10-06
Description: SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21966181; http://www-01.ibm.com/support/docview.wss?uid=swg21966181
CVE: CVE-2015-4971
Published: 2015-10-06
Description: Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21966754; http://www-01.ibm.com/support/docview.wss?uid=swg21966754
CVE: CVE-2015-4973
Published: 2015-10-06
Description: Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT10705; http://www-01.ibm.com/support/docview.wss?uid=swg21964806; http://www-01.ibm.com/support/docview.wss?uid=swg1IT10705
CVE: CVE-2015-4992
Published: 2015-10-06
Description: IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT10723; http://www-01.ibm.com/support/docview.wss?uid=swg21965734; http://www-01.ibm.com/support/docview.wss?uid=swg1IT10723
CVE: CVE-2015-5022
Published: 2015-10-06
Description: IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2, when access by guests is enabled, place an internal hostname and a payload path in a response, which allows remote authenticated users to obtain sensitive information by leveraging a trading-partner relationship and reading response fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT10702; http://www-01.ibm.com/support/docview.wss?uid=swg21967334; http://www-01.ibm.com/support/docview.wss?uid=swg1IT10702
CVE: CVE-2015-5024
Published: 2015-10-06
Description: IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967255; http://www-01.ibm.com/support/docview.wss?uid=swg21967255
CVE: CVE-2015-5640
Published: 2015-10-06
Description: baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://basercms.net/security/JVN04855224; http://jvn.jp/en/jp/JVN04855224/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000138
CVE: CVE-2015-5641
Published: 2015-10-06
Description: SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://basercms.net/security/JVN79633796; http://jvn.jp/en/jp/JVN79633796/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000139
CVE: CVE-2015-5642
Published: 2015-10-06
Description: Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN18232032/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000143; http://oss.icz.co.jp/news/?p=1073
CVE: CVE-2015-5643
Published: 2015-10-06
Description: The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN66984217/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000144; http://oss.icz.co.jp/news/?p=1073
CVE: CVE-2015-5644
Published: 2015-10-06
Description: The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN08535069/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000145; http://oss.icz.co.jp/news/?p=1075
CVE: CVE-2015-5645
Published: 2015-10-06
Description: ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN85118545/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000146; http://oss.icz.co.jp/news/?p=1075
CVE: CVE-2015-5650
Published: 2015-10-06
Description: Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN27462572/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000147; http://jvn.jp/en/jp/JVN27462572/index.html
CVE: CVE-2015-5652
Published: 2015-10-06
Description: Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory.  NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
CVSS Score: 7.2 (HIGH)
References: http://jvn.jp/en/jp/JVN49503705/995204/index.html; http://jvn.jp/en/jp/JVN49503705/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000141
CVE: CVE-2015-6549
Published: 2015-10-06
Description: Cross-site scripting (XSS) vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/76896; http://www.securitytracker.com/id/1033726; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151001_00
CVE: CVE-2015-7314
Published: 2015-10-06
Description: The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN27548431/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149; http://www.openwall.com/lists/oss-security/2015/09/22/12