deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6268
Published: 2015-08-29
Description: Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet, aka Bug ID CSCsw95482.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40685; http://www.securitytracker.com/id/1033406; http://tools.cisco.com/security/center/viewAlert.x?alertId=40685
CVE: CVE-2015-6273
Published: 2015-08-29
Description: Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40690; http://www.securitytracker.com/id/1033408; http://tools.cisco.com/security/center/viewAlert.x?alertId=40690
CVE: CVE-2015-4497
Published: 2015-08-29
Description: Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html
CVE: CVE-2015-4498
Published: 2015-08-29
Description: The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html
CVE: CVE-2015-3966
Published: 2015-08-30
Description: The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.innominate.com/data/downloads/software/innominate_security_advisory_20150714_001_en.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03; http://www.innominate.com/data/downloads/software/innominate_security_advisory_20150714_001_en.pdf
CVE: CVE-2015-4555
Published: 2015-08-30
Description: Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Rendezvous Daemon (rvd), Routing Daemon (rvrd), Secure Daemon (rvsd), Secure Routing Daemon (rvsrd), Gateway Daemon (rvgd), Daemon Adapter (rvda), Cache (rvcache), Agent (rva), and Relay Agent (rvrad) components.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1033677; http://www.tibco.com/assets/blt18493dc775c50c09/2015-002-advisory.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2015-5698
Published: 2015-08-30
Description: Cross-site request forgery (CSRF) vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/172315/Siemens-SIMATIC-S7-1200-Cross-Site-Request-Forgery.html; http://www.securitytracker.com/id/1033419; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-134003.pdf
CVE: CVE-2014-9728
Published: 2015-08-31
Description: The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1d47b262952a45aae62bd49cfaf33dd76c11a2c; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e159332b9af4b04d882dbcfe1bb0117f0a6d4b58; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec37ec154564f8690c5bd[PII_REDACTED]eeef9
CVE: CVE-2014-9729
Published: 2015-08-31
Description: The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e159332b9af4b04d882dbcfe1bb0117f0a6d4b58; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
CVE: CVE-2014-9730
Published: 2015-08-31
Description: The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec37ec154564f8690c5bd[PII_REDACTED]eeef9; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
CVE: CVE-2014-9731
Published: 2015-08-31
Description: The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c.
CVSS Score: 2.1 (LOW)
CWE: CWE-17
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
CVE: CVE-2015-1333
Published: 2015-08-31
Description: Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0; http://rhn.redhat.com/errata/RHSA-2015-1778.html; http://rhn.redhat.com/errata/RHSA-2015-1787.html
CVE: CVE-2015-3212
Published: 2015-08-31
Description: Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2d45a02d0166caf2627fe91897c6ffc3b19514c4; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
CVE: CVE-2015-3214
Published: 2015-08-31
Description: The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924; http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33; http://rhn.redhat.com/errata/RHSA-2015-1507.html
CVE: CVE-2015-3290
Published: 2015-08-31
Description: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html; http://www.debian.org/security/2015/dsa-3313
CVE: CVE-2015-3291
Published: 2015-08-31
Description: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.
CVSS Score: 2.1 (LOW)
CWE: CWE-17
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=810bc075f78ff2c221536eb3008eac6a492dba2d; http://www.debian.org/security/2015/dsa-3313; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
CVE: CVE-2015-4700
Published: 2015-08-31
Description: The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3f7352bf21f8fd7ba3e2fcef9488756f188e12be; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
CVE: CVE-2015-5157
Published: 2015-08-31
Description: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html
CVE: CVE-2015-5364
Published: 2015-08-31
Description: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=beb39db59d14990e401e235faf66a6b9b31240b0; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
CVE: CVE-2015-5366
Published: 2015-08-31
Description: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=beb39db59d14990e401e235faf66a6b9b31240b0; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
CVE: CVE-2015-5697
Published: 2015-08-31
Description: The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b6878d9e03043695dbf3fa1caa6dfc09db225b16; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163661.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163711.html
CVE: CVE-2015-5706
Published: 2015-08-31
Description: Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f15133df088ecadd141ea1907f2c96df67c729f0; http://twitter.com/grsecurity/statuses/[PII_REDACTED]10490624; http://www.debian.org/security/2015/dsa-3329
CVE: CVE-2015-5717
Published: 2015-08-31
Description: The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-504631.pdf; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-504631.pdf
CVE: CVE-2015-0942
Published: 2015-08-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-6742, CVE-2015-6743, CVE-2015-6744, CVE-2015-6745, CVE-2015-6746, CVE-2015-6747. Reason: This candidate originally combined multiple issues that have different vulnerability types and other complex abstraction issues. Notes: All CVE users should reference CVE-2015-6742, CVE-2015-6743, CVE-2015-6744, CVE-2015-6745, CVE-2015-6746, and CVE-2015-6747 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-0943
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-254
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6742
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6743
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6744
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) account locking, which allows remote attackers to "disrupt security-critical functions" by "dropping network traffic." NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6745
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6746
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoof communications with banks via unspecified vectors.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6747
Published: 2015-08-31
Description: Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2015/Jul/120; https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html; http://seclists.org/fulldisclosure/2015/Jul/120
CVE: CVE-2015-6750
Published: 2015-08-31
Description: Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133248/Ricoh-FTP-Server-1.1.0.6-Buffer-Overflow.html; http://packetstormsecurity.com/files/133248/Ricoh-FTP-Server-1.1.0.6-Buffer-Overflow.html
CVE: CVE-2014-2329
Published: 2015-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by the logwatch module, or other unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/531594; http://www.securityfocus.com/archive/1/531656; http://www.securityfocus.com/archive/1/531594
CVE: CVE-2014-2330
Published: 2015-08-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://mathias-kettner.de/check_mk_werks.php?werk_id=0766; http://www.securityfocus.com/archive/1/531594; http://www.securityfocus.com/bid/66389
CVE: CVE-2014-2331
Published: 2015-08-31
Description: Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot.  NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/531594; http://www.securityfocus.com/archive/1/531656; http://www.securityfocus.com/archive/1/531594
CVE: CVE-2014-2332
Published: 2015-08-31
Description: Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/531594; http://www.securityfocus.com/archive/1/531656; http://www.securityfocus.com/archive/1/531594
CVE: CVE-2014-2570
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codalabs.net/cla-2014-001; http://osvdb.org/show/osvdb/104896; http://www.securityfocus.com/archive/1/531587/100/0/threaded
CVE: CVE-2014-3148
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to a non-existent page, which is not properly handled in a 404 error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128338/OKCupid-Cross-Site-Scripting.html; https://github.com/okws/okws/commit/e9bedb644d106a043e33e1058bedd1c2c0b2e2e0; https://hackerone.com/reports/3317
CVE: CVE-2014-6616
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in Softing FG-100 PROFIBUS Single Channel (FG-100-PB) with firmware FG-x00-PB_V2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICE_NAME parameter to cgi-bin/CFGhttp/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/128975/Softing-FG-100-PB-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533903/100/0/threaded; http://www.securityfocus.com/bid/70917
CVE: CVE-2015-6535
Published: 2015-08-31
Description: Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133340/WordPress-YouTube-Embed-3.3.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536334/100/0/threaded; https://wordpress.org/plugins/youtube-embed/changelog/