deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7428
Published: 2016-02-29
Description: Open redirect vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 7.4 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI51589; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI51589
CVE: CVE-2015-7455
Published: 2016-02-29
Description: IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI.
CVSS Score: 3.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI51234; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI51234
CVE: CVE-2015-7457
Published: 2016-02-29
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI56432; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56432
CVE: CVE-2015-7491
Published: 2016-02-29
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI56433; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56433
CVE: CVE-2015-8524
Published: 2016-02-29
Description: Cross-site scripting (XSS) vulnerability in Process Portal in IBM Business Process Manager 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54981; http://www-01.ibm.com/support/docview.wss?uid=swg21974472; http://www.securitytracker.com/id/1035126
CVE: CVE-2016-0212
Published: 2016-02-29
Description: Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0213 and CVE-2016-0216.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216
CVE: CVE-2016-0213
Published: 2016-02-29
Description: Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0212 and CVE-2016-0216.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216
CVE: CVE-2016-0216
Published: 2016-02-29
Description: Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0212 and CVE-2016-0213.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216
CVE: CVE-2016-0225
Published: 2016-02-29
Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive information via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54585; http://www-01.ibm.com/support/docview.wss?uid=swg21976623; http://www-01.ibm.com/support/docview.wss?uid=swg1JR54585
CVE: CVE-2016-0243
Published: 2016-02-29
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0244.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI54088; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www.securityfocus.com/bid/100572
CVE: CVE-2016-0244
Published: 2016-02-29
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0243.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI55327; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI55327
CVE: CVE-2016-0245
Published: 2016-02-29
Description: The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI56682; http://www.ibm.com/support/docview.wss?uid=swg21975358; http://www-01.ibm.com/support/docview.wss?uid=swg1PI56682
CVE: CVE-2016-1353
Published: 2016-03-01
Description: The TCP implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.3(0), 3.3(1), 4.0(0), and 4.1(0) does not properly initiate new TCP sessions when a previous session is in a FIN wait state, which allows remote attackers to cause a denial of service (TCP outage) via vectors involving FIN packets, aka Bug ID CSCuy45136.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160226-vds-is; http://www.securitytracker.com/id/1035123; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160226-vds-is
CVE: CVE-2016-2559
Published: 2016-03-01
Description: Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html; https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c
CVE: CVE-2016-2560
Published: 2016-03-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html
CVE: CVE-2016-2561
Published: 2016-03-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html
CVE: CVE-2016-2562
Published: 2016-03-01
Description: The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html; https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976
CVE: CVE-2016-0800
Published: 2016-03-01
Description: The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10722; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
CVE: CVE-2016-0703
Published: 2016-03-02
Description: The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
CVE: CVE-2016-0704
Published: 2016-03-02
Description: An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
CVE: CVE-2016-2278
Published: 2016-03-02
Description: Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (aka Minimal Shell) protection mechanism.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01; https://www.exploit-db.com/exploits/39522/
CVE: CVE-2016-2279
Published: 2016-03-02
Description: Cross-site scripting (XSS) vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L* before 28.011+ allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035190; https://ics-cert.us-cert.gov/advisories/ICSA-16-061-02; https://www.exploit-db.com/exploits/44626/
CVE: CVE-2016-8000
Published: 2016-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-0800.  Reason: This candidate is a duplicate of CVE-2016-0800.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2016-0800 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-1329
Published: 2016-03-03
Description: Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on Nexus 3500 devices has hardcoded credentials, which allows remote attackers to obtain root privileges via a (1) TELNET or (2) SSH session, aka Bug ID CSCuy25800.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n3k; http://www.securitytracker.com/id/1035161; https://isc.sans.edu/forums/diary/20795
CVE: CVE-2016-1354
Published: 2016-03-03
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 8.x before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCud41176.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cucdm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cucdm
CVE: CVE-2016-1355
Published: 2016-03-03
Description: Cross-site scripting (XSS) vulnerability in the Device Management UI in the management interface in Cisco FireSIGHT System Software 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuy41687.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT; http://www.securitytracker.com/id/1035188; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT
CVE: CVE-2016-0702
Published: 2016-03-03
Description: The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: http://cachebleed.info; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html
CVE: CVE-2016-0705
Published: 2016-03-03
Description: Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
CVSS Score: 9.8 (CRITICAL)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html
CVE: CVE-2016-0797
Published: 2016-03-03
Description: Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
CVSS Score: 7.5 (HIGH)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
CVE: CVE-2016-0798
Published: 2016-03-03
Description: Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
CVE: CVE-2016-0799
Published: 2016-03-03
Description: The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html
CVE: CVE-2016-2842
Published: 2016-03-03
Description: The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0210&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3441&w=2; http://openssl.org/news/secadv/20160301.txt
CVE: CVE-2015-0718
Published: 2016-03-03
Description: Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session, aka Bug ID CSCub70579.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-netstack; http://www.securitytracker.com/id/1035159; http://www.securitytracker.com/id/1035160
CVE: CVE-2015-6260
Published: 2016-03-03
Description: Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n5ksnmp; http://www.securitytracker.com/id/1035158; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n5ksnmp
CVE: CVE-2015-7490
Published: 2016-03-03
Description: IBM InfoSphere Information Server 8.5 through FP3, 8.7 through FP2, 9.1 through 9.1.2.0, 11.3 through 11.3.1.2, and 11.5 allows remote authenticated users to bypass intended access restrictions via a modified cookie.
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54787; http://www-01.ibm.com/support/docview.wss?uid=swg21975827; http://www.securitytracker.com/id/1035125
CVE: CVE-2016-0227
Published: 2016-03-03
Description: Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR55152; http://www-01.ibm.com/support/docview.wss?uid=swg21978058; http://www.securitytracker.com/id/1035175
CVE: CVE-2016-1158
Published: 2016-03-03
Description: Cross-site request forgery (CSRF) vulnerability on Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://corega.jp/support/security/20160229_wlbargmh_wlbargnl.htm; http://jvn.jp/en/jp/JVN59349382/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000032
CVE: CVE-2016-1288
Published: 2016-03-03
Description: The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intranet connectivity and sending a malformed HTTPS request, aka Bug ID CSCuu24840.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-wsa; http://www.securitytracker.com/id/1035163; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-wsa
CVE: CVE-2016-1356
Published: 2016-03-03
Description: Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615.
CVSS Score: 3.7 (LOW)
CWE: CWE-255, CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT1; http://www.securitytracker.com/id/1035189; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT1
CVE: CVE-2016-1357
Published: 2016-03-03
Description: The password-management administration component in Cisco Policy Suite (CPS) 7.0.1.3, 7.0.2, 7.0.2-att, 7.0.3-att, 7.0.4-att, and 7.5.0 allows remote attackers to bypass intended RBAC restrictions and read unspecified data via unknown vectors, aka Bug ID CSCut85211.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-psc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-psc