deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7198
Published: 2015-11-05
Description: Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7199
Published: 2015-11-05
Description: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7200
Published: 2015-11-05
Description: The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-6291
Published: 2015-11-06
Description: Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-esa2; http://www.securitytracker.com/id/1034064; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-esa2
CVE: CVE-2015-6293
Published: 2015-11-06
Description: Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple file-range requests, aka Bug ID CSCur39155.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa2; http://www.securitytracker.com/id/1034063; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa2
CVE: CVE-2015-6321
Published: 2015-11-06
Description: Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032, 9.1.1 before 9.1.1-005, and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets, aka Bug IDs CSCus79774, CSCus79777, and CSCzv95795.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-aos; http://www.securitytracker.com/id/1034060; http://www.securitytracker.com/id/1034061
CVE: CVE-2015-4282
Published: 2015-11-06
Description: Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-privmse; http://www.securityfocus.com/bid/77435; http://www.securitytracker.com/id/1034066
CVE: CVE-2015-5672
Published: 2015-11-06
Description: TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN80144272/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000174; http://www.typemoon.com/support/vulnerability150902.html
CVE: CVE-2015-6292
Published: 2015-11-06
Description: The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple proxy connections, aka Bug ID CSCus10922.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa1; http://www.securitytracker.com/id/1034062; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa1
CVE: CVE-2015-6298
Published: 2015-11-06
Description: The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments, aka Bug ID CSCus83445.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa; http://www.securitytracker.com/id/1034059; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-wsa
CVE: CVE-2015-6316
Published: 2015-11-06
Description: The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-mse-cred; http://www.securityfocus.com/bid/77432; http://www.securitytracker.com/id/1034065
CVE: CVE-2015-7770
Published: 2015-11-06
Description: Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN90135579/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000176; http://www.securitytracker.com/id/1034092
CVE: CVE-2015-8075
Published: 2015-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5305
Published: 2015-11-06
Description: Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: https://access.redhat.com/errata/RHSA-2015:1945; https://bugzilla.redhat.com/show_bug.cgi?id=1273969; https://access.redhat.com/errata/RHSA-2015:1945
CVE: CVE-2015-6546
Published: 2015-11-06
Description: The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1033952; https://support.f5.com/kb/en-us/solutions/public/17000/300/sol17386.html; http://www.securitytracker.com/id/1033952
CVE: CVE-2015-7394
Published: 2015-11-06
Description: The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034025; http://www.securitytracker.com/id/1034026; https://support.f5.com/kb/en-us/solutions/public/17000/400/sol17407.html
CVE: CVE-2015-7696
Published: 2015-11-06
Description: Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3386; http://www.openwall.com/lists/oss-security/2015/09/07/4; http://www.openwall.com/lists/oss-security/2015/09/15/6
CVE: CVE-2015-7697
Published: 2015-11-06
Description: Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://sourceforge.net/p/infozip/patches/23/; http://www.debian.org/security/2015/dsa-3386; http://www.openwall.com/lists/oss-security/2015/09/07/4
CVE: CVE-2014-9749
Published: 2015-11-06
Description: Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.squid-cache.org/show_bug.cgi?id=4066; http://lists.opensuse.org/opensuse-updates/2015-10/msg00052.html; http://www.openwall.com/lists/oss-security/2015/10/01/1
CVE: CVE-2015-5225
Published: 2015-11-06
Description: Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165484.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166798.html
CVE: CVE-2015-6855
Published: 2015-11-06
Description: hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html
CVE: CVE-2015-7762
Published: 2015-11-06
Description: rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2015/dsa-3387; http://www.securitytracker.com/id/1034039; https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html
CVE: CVE-2015-7763
Published: 2015-11-06
Description: rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2015/dsa-3387; http://www.securitytracker.com/id/1034039; https://lists.openafs.org/pipermail/openafs-announce/2015/000493.html
CVE: CVE-2015-7809
Published: 2015-11-06
Description: The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2015/08/21/3; http://openwall.com/lists/oss-security/2015/10/11/2; http://symfony.com/blog/security-release-twig-1-20-0
CVE: CVE-2015-8081
Published: 2015-11-06
Description: The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2603420; https://www.drupal.org/node/2603560; https://www.drupal.org/node/2603420
CVE: CVE-2015-8082
Published: 2015-11-06
Description: The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_logout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL Login modules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: https://www.drupal.org/node/2303503; https://www.drupal.org/node/2571567; https://www.drupal.org/node/2587641
CVE: CVE-2015-6476
Published: 2015-11-07
Description: Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which makes it easier for remote attackers to obtain access via an SSH session.
CVSS Score: 10.0 (HIGH)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-309-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-309-01
CVE: CVE-2015-7254
Published: 2015-11-07
Description: Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.huawei.com/en/psirt/security-advisories/hw-462908; http://www.kb.cert.org/vuls/id/438928; http://www.securityfocus.com/bid/77506
CVE: CVE-2015-7395
Published: 2015-11-08
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended work-order change restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969072; http://www-01.ibm.com/support/docview.wss?uid=swg21969072
CVE: CVE-2015-1989
Published: 2015-11-08
Description: SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970116; http://www-01.ibm.com/support/docview.wss?uid=swg21970116
CVE: CVE-2015-1993
Published: 2015-11-08
Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968270; http://www-01.ibm.com/support/docview.wss?uid=swg21968270
CVE: CVE-2015-1994
Published: 2015-11-08
Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968271; http://www-01.ibm.com/support/docview.wss?uid=swg21968271
CVE: CVE-2015-1995
Published: 2015-11-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968326; http://www-01.ibm.com/support/docview.wss?uid=swg21968326
CVE: CVE-2015-1996
Published: 2015-11-08
Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970139; http://www-01.ibm.com/support/docview.wss?uid=swg21970139
CVE: CVE-2015-1997
Published: 2015-11-08
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970140; http://www-01.ibm.com/support/docview.wss?uid=swg21970140
CVE: CVE-2015-1999
Published: 2015-11-08
Description: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968269; http://www-01.ibm.com/support/docview.wss?uid=swg21968269
CVE: CVE-2015-2017
Published: 2015-11-08
Description: CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI45266; http://www-01.ibm.com/support/docview.wss?uid=swg21966837; http://www.securityfocus.com/bid/78457
CVE: CVE-2015-4928
Published: 2015-11-08
Description: Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969202; http://www.securitytracker.com/id/1034102; http://www-01.ibm.com/support/docview.wss?uid=swg21969202
CVE: CVE-2015-4940
Published: 2015-11-08
Description: Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969202; http://www.securitytracker.com/id/1034102; http://www-01.ibm.com/support/docview.wss?uid=swg21969202
CVE: CVE-2015-4963
Published: 2015-11-08
Description: IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV71196; http://www-01.ibm.com/support/docview.wss?uid=swg21964828; http://www.securitytracker.com/id/1034103
CVE: CVE-2015-4966
Published: 2015-11-08
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968191; http://www-01.ibm.com/support/docview.wss?uid=swg21968191
CVE: CVE-2015-5005
Published: 2015-11-08
Description: CSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform an "su root" action by leveraging presence on the cluster-wide password-change list.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/powerha_advisory.asc; http://www-01.ibm.com/support/docview.wss?uid=isg1IV76943; http://www-01.ibm.com/support/docview.wss?uid=isg1IV76946
CVE: CVE-2015-5015
Published: 2015-11-08
Description: IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR53970; http://www-01.ibm.com/support/docview.wss?uid=swg24041027; http://www.securitytracker.com/id/1034104
CVE: CVE-2015-5019
Published: 2015-11-08
Description: IBM Sterling Integrator 5.1 before 5010004_8 and Sterling B2B Integrator 5.2 before 5020500_9 allow remote authenticated users to read or upload files by leveraging a password-change requirement.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT11008; http://www-01.ibm.com/support/docview.wss?uid=swg21967781; http://www-01.ibm.com/support/docview.wss?uid=swg1IT11008
CVE: CVE-2015-5043
Published: 2015-11-08
Description: diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968616; http://www-01.ibm.com/support/docview.wss?uid=swg21968616
CVE: CVE-2015-5044
Published: 2015-11-08
Description: The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers to cause a denial of service via unspecified packets.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969422; http://www-01.ibm.com/support/docview.wss?uid=swg21969422