deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3382
Published: 2015-04-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Node basket module for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add or (2) remove nodes from a basket via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72616; https://www.drupal.org/node/2424419
CVE: CVE-2015-3383
Published: 2015-04-21
Description: Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72616; https://www.drupal.org/node/2424419
CVE: CVE-2015-3384
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72615; https://www.drupal.org/node/2424435
CVE: CVE-2015-3385
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Path module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link to path" field formatter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72586; https://www.drupal.org/node/2424411
CVE: CVE-2015-3386
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Node Access Product module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72619; https://www.drupal.org/node/2424349
CVE: CVE-2015-3387
Published: 2015-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Tools module before 7.x-1.4 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via a (1) node or (2) taxonomy term title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72588; https://www.drupal.org/node/2424059
CVE: CVE-2015-3388
Published: 2015-04-21
Description: Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/02/13/12; http://www.securityfocus.com/bid/72615; https://www.drupal.org/node/2424435
CVE: CVE-2015-3389
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Download counts report page in the Public Download Count module (pubdlcnt) 7.x-1.x-dev and earlier for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/05/16; http://www.securityfocus.com/bid/74271; https://exchange.xforce.ibmcloud.com/vulnerabilities/100653
CVE: CVE-2015-3390
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/05/16; http://www.securityfocus.com/bid/72570; https://exchange.xforce.ibmcloud.com/vulnerabilities/100655
CVE: CVE-2015-3391
Published: 2015-04-21
Description: The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/02/05/16; http://www.securityfocus.com/bid/72569; https://exchange.xforce.ibmcloud.com/vulnerabilities/100672
CVE: CVE-2015-3392
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the Ajax Timeline module before 7.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/05/16; http://www.securityfocus.com/bid/72567; https://exchange.xforce.ibmcloud.com/vulnerabilities/100654
CVE: CVE-2015-3393
Published: 2015-04-21
Description: Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/02/05/16; http://www.securityfocus.com/bid/72563; https://exchange.xforce.ibmcloud.com/vulnerabilities/100656
CVE: CVE-2015-0704
Published: 2015-04-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in API features in Cisco Unified MeetingPlace 8.6(1.9) allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38460; http://www.securitytracker.com/id/1032334; http://tools.cisco.com/security/center/viewAlert.x?alertId=38460
CVE: CVE-2015-0705
Published: 2015-04-22
Description: Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38461; http://www.securityfocus.com/bid/74258; http://www.securitytracker.com/id/1032335
CVE: CVE-2015-3035
Published: 2015-04-22
Description: Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html; http://seclists.org/fulldisclosure/2015/Apr/26; http://www.securityfocus.com/archive/1/535240/100/0/threaded
CVE: CVE-2015-1484
Published: 2015-04-22
Description: Unquoted Windows search path vulnerability in the agent in Symantec Workspace Streaming (SWS) 6.1 before SP8 MP2 HF7 and 7.5 before SP1 HF4, when AppMgrService.exe is configured as a service, allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe.
CVSS Score: 6.9 (MEDIUM)
References: http://www.securityfocus.com/bid/73925; http://www.securitytracker.com/id/1032133; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150410_00
CVE: CVE-2015-1889
Published: 2015-04-22
Description: The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700654; http://www.securitytracker.com/id/1032150; http://www-01.ibm.com/support/docview.wss?uid=swg21700654
CVE: CVE-2015-3404
Published: 2015-04-22
Description: The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing (and creating) the PDF certificates."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/01/29/6; http://www.openwall.com/lists/oss-security/2015/04/21/8; http://www.securityfocus.com/bid/74282
CVE: CVE-2015-0706
Published: 2015-04-23
Description: Open redirect vulnerability in Cisco FireSIGHT System Software 5.3.1.1, 5.3.1.2, and 6.0.0 in FireSIGHT Management Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted HTTP header, aka Bug IDs CSCut06060, CSCut06056, and CSCus98966.
CVSS Score: 5.8 (MEDIUM)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38486; http://tools.cisco.com/security/center/viewAlert.x?alertId=38486
CVE: CVE-2015-0707
Published: 2015-04-23
Description: Cross-site scripting (XSS) vulnerability in Cisco FireSIGHT System Software 5.3.1.1 and 6.0.0 in FireSIGHT Management Center allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCus85425.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38487; http://tools.cisco.com/security/center/viewAlert.x?alertId=38487
CVE: CVE-2015-0910
Published: 2015-04-24
Description: Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/; http://jvn.jp/en/jp/JVN26860747/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000054
CVE: CVE-2015-0911
Published: 2015-04-24
Description: Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/; http://jvn.jp/en/jp/JVN41653647/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000055
CVE: CVE-2011-4403
Published: 2015-04-24
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/79137; http://seclists.org/fulldisclosure/2012/Feb/171; http://osvdb.org/79137
CVE: CVE-2012-2930
Published: 2015-04-24
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers.php via the user parameter to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/82961; http://www.tinywebgallery.com/forum/web-photo-gallery-news-f14/twg-1-8-8-is-available-t3274.html; https://www.htbridge.com/advisory/HTB23093
CVE: CVE-2012-2932
Published: 2015-04-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter in a (1) copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/82962; http://www.securityfocus.com/bid/54019; http://www.tinywebgallery.com/forum/web-photo-gallery-news-f14/twg-1-8-8-is-available-t3274.html
CVE: CVE-2012-5451
Published: 2015-04-24
Description: Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/56853; http://www.tvmobili.com/changelog.php; https://www.htbridge.com/advisory/HTB23120
CVE: CVE-2015-0297
Published: 2015-04-24
Description: Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2015-0862.html; http://www.securitytracker.com/id/1032181; http://rhn.redhat.com/errata/RHSA-2015-0862.html
CVE: CVE-2015-0846
Published: 2015-04-24
Description: django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2015/dsa-3230; https://github.com/jamesturk/django-markupfield/blob/master/CHANGELOG; http://www.debian.org/security/2015/dsa-3230
CVE: CVE-2015-3143
Published: 2015-04-24
Description: cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2015-0179.html; http://curl.haxx.se/docs/adv_20150422A.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
CVE: CVE-2015-3144
Published: 2015-04-24
Description: The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://curl.haxx.se/docs/adv_20150422D.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
CVE: CVE-2015-3145
Published: 2015-04-24
Description: The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0179.html; http://curl.haxx.se/docs/adv_20150422C.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
CVE: CVE-2015-3148
Published: 2015-04-24
Description: cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://advisories.mageia.org/MGASA-2015-0179.html; http://curl.haxx.se/docs/adv_20150422B.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
CVE: CVE-2015-3310
Published: 2015-04-24
Description: Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0173.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00147.html; http://www.debian.org/security/2015/dsa-3228
CVE: CVE-2015-3414
Published: 2015-04-24
Description: SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://rhn.redhat.com/errata/RHSA-2015-1635.html
CVE: CVE-2015-3415
Published: 2015-04-24
Description: The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://rhn.redhat.com/errata/RHSA-2015-1635.html
CVE: CVE-2015-3416
Published: 2015-04-24
Description: The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://rhn.redhat.com/errata/RHSA-2015-1634.html
CVE: CVE-2015-3417
Published: 2015-04-24
Description: Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Apr/31; http://www.debian.org/security/2015/dsa-3288; http://www.securityfocus.com/bid/74385
CVE: CVE-2014-6090
Published: 2015-04-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and 6.0.5 before 6.0.5.6 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21697726; http://www-01.ibm.com/support/docview.wss?uid=swg21697726
CVE: CVE-2014-6092
Published: 2015-04-27
Description: IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause a denial of service (web-service outage) by making many login attempts with a valid caseworker account name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg21697742; http://www-01.ibm.com/support/docview.wss?uid=swg21697742
CVE: CVE-2015-0113
Published: 2015-04-27
Description: The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Engineering Lifecycle Manager 4.0.3 through 4.0.7 and 5.0 through 5.0.2, Rational Rhapsody Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, and Rational Software Architect Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2 allows remote attackers to read JSP source code via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21882770; http://www-01.ibm.com/support/docview.wss?uid=swg21882770
CVE: CVE-2015-0176
Published: 2015-04-27
Description: Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699549; http://www.securitytracker.com/id/1032200; http://www-01.ibm.com/support/docview.wss?uid=swg21699549
CVE: CVE-2015-1886
Published: 2015-04-27
Description: The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI37356; http://www-01.ibm.com/support/docview.wss?uid=swg21701566; http://www.securityfocus.com/bid/74216
CVE: CVE-2015-1908
Published: 2015-04-27
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI37661; http://www-01.ibm.com/support/docview.wss?uid=swg21701566; http://www.securityfocus.com/bid/74218
CVE: CVE-2015-2706
Published: 2015-04-27
Description: Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-updates/2015-04/msg00044.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00046.html; http://www.mozilla.org/security/announce/2015/mfsa2015-45.html
CVE: CVE-2015-0174
Published: 2015-04-27
Description: The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI21072; http://www-01.ibm.com/support/docview.wss?uid=swg21697368; http://www.securitytracker.com/id/1032190