deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1849
Published: 2017-09-19
Description: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1199641; https://bugzilla.redhat.com/show_bug.cgi?id=1208580; https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e
CVE: CVE-2017-10784
Published: 2017-09-19
Description: The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/100853; http://www.securitytracker.com/id/1039363; http://www.securitytracker.com/id/1042004
CVE: CVE-2017-14033
Published: 2017-09-19
Description: The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100868; http://www.securitytracker.com/id/1039363; http://www.securitytracker.com/id/1042004
CVE: CVE-2017-6315
Published: 2017-09-19
Description: Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/42726/; https://www.exploit-db.com/exploits/42726/
CVE: CVE-2017-12837
Published: 2017-09-19
Description: Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3982; http://www.securityfocus.com/bid/100860; https://bugzilla.redhat.com/show_bug.cgi?id=1492091
CVE: CVE-2017-12883
Published: 2017-09-19
Description: Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch; http://www.debian.org/security/2017/dsa-3982; http://www.securityfocus.com/bid/100852
CVE: CVE-2014-8684
Published: 2017-09-19
Description: CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html; http://seclists.org/fulldisclosure/2014/May/54; https://github.com/kohana/core/pull/492
CVE: CVE-2014-8686
Published: 2017-09-19
Description: CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html; https://beyondbinary.io/articles/seagate-nas-rce/; https://codeigniter.com/userguide2/changelog.html
CVE: CVE-2015-4681
Published: 2017-09-19
Description: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2015/Jun/81; http://www.securityfocus.com/archive/1/535852/100/0/threaded; http://www.securityfocus.com/bid/75432
CVE: CVE-2015-4682
Published: 2017-09-19
Description: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/132463/Polycom-RealPresence-Resource-Manager-RPRM-Disclosure-Traversal.html; http://seclists.org/fulldisclosure/2015/Jun/81; http://www.securityfocus.com/archive/1/535852/100/0/threaded
CVE: CVE-2015-4683
Published: 2017-09-19
Description: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132463/Polycom-RealPresence-Resource-Manager-RPRM-Disclosure-Traversal.html; http://seclists.org/fulldisclosure/2015/Jun/81; http://www.securityfocus.com/archive/1/535852/100/0/threaded
CVE: CVE-2015-4684
Published: 2017-09-19
Description: Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. (dot dot) in the Modifier parameter to PlcmRmWeb/FileDownload; or remote authenticated administrators to upload arbitrary files via the (2) Filename or (3) SE_FNAME parameter to PlcmRmWeb/FileUpload or to read and remove arbitrary files via the (4) filePathName parameter in an importSipUriReservations SOAP request to PlcmRmWeb/JUserManager.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/132463/Polycom-RealPresence-Resource-Manager-RPRM-Disclosure-Traversal.html; http://seclists.org/fulldisclosure/2015/Jun/81; http://www.securityfocus.com/archive/1/535852/100/0/threaded
CVE: CVE-2015-4685
Published: 2017-09-19
Description: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132463/Polycom-RealPresence-Resource-Manager-RPRM-Disclosure-Traversal.html; http://seclists.org/fulldisclosure/2015/Jun/81; http://www.securityfocus.com/archive/1/535852/100/0/threaded
CVE: CVE-2017-12168
Published: 2017-09-20
Description: The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR).
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-617, CWE-617
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9e3f7a29694049edd728e2400ab57ad7553e5aa9; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.11; https://bugzilla.redhat.com/show_bug.cgi?id=1492984
CVE: CVE-2017-14604
Published: 2017-09-20
Description: GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3994; http://www.securityfocus.com/bid/101012; https://access.redhat.com/errata/RHSA-2018:0223
CVE: CVE-2017-8770
Published: 2017-09-20
Description: There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf; https://www.exploit-db.com/exploits/42547/; http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf
CVE: CVE-2017-8771
Published: 2017-09-20
Description: On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root"). The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the device with malicious code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf; http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf
CVE: CVE-2017-8772
Published: 2017-09-20
Description: On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root") and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires (malicious or not).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf; http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf
CVE: CVE-2015-1329
Published: 2017-09-20
Description: Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1329.html; http://www.securityfocus.com/bid/76174; http://www.ubuntu.com/usn/USN-2677-1
CVE: CVE-2015-4072
Published: 2017-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/102; http://www.securityfocus.com/bid/75971
CVE: CVE-2015-4073
Published: 2017-09-20
Description: Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/102; http://www.securityfocus.com/bid/75971
CVE: CVE-2015-4074
Published: 2017-09-20
Description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/102; http://www.securityfocus.com/bid/75971
CVE: CVE-2015-4075
Published: 2017-09-20
Description: The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jul/102; http://www.securityfocus.com/bid/75971
CVE: CVE-2015-5179
Published: 2017-09-20
Description: FreeIPA might display user data improperly via vectors involving non-printable characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1252567; https://pagure.io/freeipa/issue/5153; https://bugzilla.redhat.com/show_bug.cgi?id=1252567
CVE: CVE-2015-5248
Published: 2017-09-20
Description: Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1272326; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-017/?fid=7150; https://bugzilla.redhat.com/show_bug.cgi?id=1272326
CVE: CVE-2015-5607
Published: 2017-09-20
Description: Cross-site request forgery in the REST API in IPython 2 and 3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162671.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162936.html; http://www.openwall.com/lists/oss-security/2015/07/21/3
CVE: CVE-2015-8224
Published: 2017-09-20
Description: Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-459832.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-459832.htm
CVE: CVE-2017-14339
Published: 2017-09-20
Description: The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop. This can cause high CPU usage and makes the server unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-4001; https://github.com/yadifa/yadifa/blob/v2.2.6/ChangeLog; https://www.tarlogic.com/blog/fuzzing-yadifa-dns/
CVE: CVE-2017-7924
Published: 2017-09-20
Description: An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, and 1763-L16DWD. A remote, unauthenticated attacker could send a single, specially crafted Programmable Controller Communication Commands (PCCC) packet to the controller that could potentially cause the controller to enter a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/99622; https://ics-cert.us-cert.gov/advisories/ICSA-17-138-03; http://www.securityfocus.com/bid/99622
CVE: CVE-2017-9607
Published: 2017-09-20
Description: The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check protection mechanism, cause a denial of service, or possibly have unspecified other impact via a crafted AArch32 image, which triggers an integer overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190
References: https://github.com/ARM-software/arm-trusted-firmware/blob/v1.4/docs/change-log.rst#new-features; https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-4; https://github.com/ARM-software/arm-trusted-firmware/blob/v1.4/docs/change-log.rst#new-features
CVE: CVE-2017-9645
Published: 2017-09-20
Description: An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). Decryption of data is possible at the hardware level.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: http://www.securityfocus.com/bid/100001; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-02; http://www.securityfocus.com/bid/100001
CVE: CVE-2017-9649
Published: 2017-09-20
Description: A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). An unchangeable, factory-set key is included in the 900 MHz transmitter firmware.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-321, CWE-798
References: http://www.securityfocus.com/bid/100001; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-02; http://www.securityfocus.com/bid/100001
CVE: CVE-2016-6795
Published: 2017-09-20
Description: In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/93773; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://struts.apache.org/docs/s2-042.html
CVE: CVE-2016-8738
Published: 2017-09-20
Description: In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94657; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://struts.apache.org/docs/s2-044.html
CVE: CVE-2017-12611
Published: 2017-09-20
Description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/100829
CVE: CVE-2017-14607
Published: 2017-09-20
Description: In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100944; https://github.com/ImageMagick/ImageMagick/issues/765; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-14608
Published: 2017-09-20
Description: In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b[PII_REDACTED]a188c16a395f1d21; https://github.com/LibRaw/LibRaw/issues/101; https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b[PII_REDACTED]a188c16a395f1d21
CVE: CVE-2017-9793
Published: 2017-09-20
Description: The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htm; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/100611
CVE: CVE-2017-9804
Published: 2017-09-20
Description: In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/100612
CVE: CVE-2014-9758
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://appcheck-ng.com/unpatched-vulnerabilites-in-magento-e-commerce-platform/; http://www.openwall.com/lists/oss-security/2015/12/05/4; http://appcheck-ng.com/unpatched-vulnerabilites-in-magento-e-commerce-platform/
CVE: CVE-2015-0162
Published: 2017-09-20
Description: IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/74038; https://exchange.xforce.ibmcloud.com/vulnerabilities/100865; https://www-01.ibm.com/support/docview.wss?uid=swg21700012
CVE: CVE-2015-1865
Published: 2017-09-20
Description: fts.c in coreutils 8.4 allows local users to delete arbitrary files.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362, CWE-367
References: http://www.securityfocus.com/bid/76073; https://bugzilla.redhat.com/show_bug.cgi?id=1211300; http://www.securityfocus.com/bid/76073
CVE: CVE-2015-1866
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/14/11; http://www.securityfocus.com/bid/74185; https://emberjs.com/blog/2015/04/14/security-and-bugfix-releases-ember-1-10-1-1-11-2-1-11-3.html
CVE: CVE-2015-2826
Published: 2017-09-20
Description: WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/131281/WordPress-Simple-Ads-Manager-2.5.94-2.5.96-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/Apr/10; http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html
CVE: CVE-2015-2927
Published: 2017-09-20
Description: node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2015/04/06/3; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777013; https://bugzilla.redhat.com/show_bug.cgi?id=1209781
CVE: CVE-2015-3890
Published: 2017-09-20
Description: Use-after-free vulnerability in Open Litespeed before 1.3.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.security-assessment.com/files/documents/advisory/Open%20Litespeed%20Use%20After%20Free%20Vulnerability.pdf; http://www.security-assessment.com/files/documents/advisory/Open%20Litespeed%20Use%20After%20Free%20Vulnerability.pdf
CVE: CVE-2015-4707
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/06/22/7; http://www.securityfocus.com/bid/75328; https://bugzilla.redhat.com/show_bug.cgi?id=1235688