deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1351
Published: 2016-03-26
Description: The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of service (device reload) via a crafted header in a packet, aka Bug ID CSCuu64279.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-lisp; http://www.securitytracker.com/id/1035383; http://www.securitytracker.com/id/1035384
CVE: CVE-2016-3119
Published: 2016-03-26
Description: The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
CVSS Score: 5.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html; http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html; http://rhn.redhat.com/errata/RHSA-2016-2591.html
CVE: CVE-2014-9769
Published: 2016-03-28
Description: pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://vcs.pcre.org/pcre?view=revision&revision=1475; http://www.openwall.com/lists/oss-security/2016/03/26/1; http://www.securityfocus.com/bid/85570
CVE: CVE-2016-0226
Published: 2016-03-28
Description: The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap executable files, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21978598; http://www.securitytracker.com/id/1035286; http://zerodayinitiative.com/advisories/ZDI-16-208/
CVE: CVE-2016-1314
Published: 2016-03-28
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (CDM) 8.1(1) allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux80760.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160328-ucdm; http://www.securitytracker.com/id/1035425; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160328-ucdm
CVE: CVE-2016-2344
Published: 2016-03-28
Description: Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted command.  NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/732760; http://www.securitytracker.com/id/1035426; http://www.kb.cert.org/vuls/id/732760
CVE: CVE-2016-1646
Published: 2016-03-29
Description: The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-1647
Published: 2016-03-29
Description: Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-1648
Published: 2016-03-29
Description: Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-1649
Published: 2016-03-29
Description: The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type mismatch, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted shader stages.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-1650
Published: 2016-03-29
Description: The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-3679
Published: 2016-03-29
Description: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
CVE: CVE-2016-1760
Published: 2016-03-29
Description: The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://www.securitytracker.com/id/1035353; https://support.apple.com/HT206166
CVE: CVE-2016-2288
Published: 2016-03-29
Description: Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-084-01; https://www.exploit-db.com/exploits/39630/; https://ics-cert.us-cert.gov/advisories/ICSA-16-084-01
CVE: CVE-2015-8836
Published: 2016-03-30
Description: Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3551; http://www.openwall.com/lists/oss-security/2015/02/06/7; http://www.openwall.com/lists/oss-security/2015/02/23/9
CVE: CVE-2015-8837
Published: 2016-03-30
Description: Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3551; http://www.openwall.com/lists/oss-security/2015/02/06/7; http://www.openwall.com/lists/oss-security/2015/02/23/9
CVE: CVE-2016-3141
Published: 2016-03-31
Description: Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b1bd4119bcafab6f9a8f84d92cd65eec3afeface; http://lists.apple.com/archives/security-announce/2016/May/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
CVE: CVE-2016-3142
Published: 2016-03-31
Description: The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/May/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html
CVE: CVE-2016-1345
Published: 2016-04-01
Description: Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers, aka Bug ID CSCux22726.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160330-fp; http://www.securitytracker.com/id/1035437; http://www.securitytracker.com/id/1035438
CVE: CVE-2016-1167
Published: 2016-04-01
Description: Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jpn.nec.com/security-info/secinfo/nv16-005.html; http://jvn.jp/en/jp/JVN82020528/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000036
CVE: CVE-2016-1168
Published: 2016-04-01
Description: Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jpn.nec.com/security-info/secinfo/nv16-004.html; http://jvn.jp/en/jp/JVN07818796/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000035
CVE: CVE-2016-0793
Published: 2016-04-01
Description: Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html; https://bugzilla.redhat.com/show_bug.cgi?id=1305937; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2015-6264
Published: 2016-04-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-1349.  Reason: This candidate is a reservation duplicate of CVE-2016-1349.  Notes: All CVE users should reference CVE-2016-1349 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2289
Published: 2016-04-01
Description: Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-091-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-091-01
CVE: CVE-2016-2343
Published: 2016-04-01
Description: Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient information via SQL statements.
CVSS Score: 9.8 (CRITICAL)
References: http://justinshafer.blogspot.com/2016/02/moving-onto-eaglesoft-aka-patterson.html; http://www.kb.cert.org/vuls/id/344432; http://justinshafer.blogspot.com/2016/02/moving-onto-eaglesoft-aka-patterson.html
CVE: CVE-2015-8519
Published: 2016-04-05
Description: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8520, CVE-2015-8521, and CVE-2015-8522.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975536; http://www.securityfocus.com/bid/84161; http://www-01.ibm.com/support/docview.wss?uid=swg21975536
CVE: CVE-2015-8520
Published: 2016-04-05
Description: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975536; http://www.securityfocus.com/bid/84166; http://www-01.ibm.com/support/docview.wss?uid=swg21975536
CVE: CVE-2015-8521
Published: 2016-04-05
Description: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8522.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975536; http://www.securityfocus.com/bid/84167; http://www-01.ibm.com/support/docview.wss?uid=swg21975536
CVE: CVE-2015-8522
Published: 2016-04-05
Description: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8521.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975536; http://www.securityfocus.com/bid/84163; http://www-01.ibm.com/support/docview.wss?uid=swg21975536
CVE: CVE-2015-8523
Published: 2016-04-05
Description: The server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to cause a denial of service (service crash) via crafted packets to a TCP port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21975536; http://www.securityfocus.com/bid/84164; http://www-01.ibm.com/support/docview.wss?uid=swg21975536
CVE: CVE-2016-0289
Published: 2016-04-05
Description: shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21979519; http://www-01.ibm.com/support/docview.wss?uid=swg21979519
CVE: CVE-2016-1175
Published: 2016-04-05
Description: Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN47164236/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000039; http://www.sharp.co.jp/support/photoplayer/fw_update.html
CVE: CVE-2016-1176
Published: 2016-04-05
Description: Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN41875357/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000038; http://jvn.jp/en/jp/JVN41875357/index.html
CVE: CVE-2016-1789
Published: 2016-04-05
Description: Apple iBooks Author before 2.4.1 allows remote attackers to read arbitrary files via an iBooks Author file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00008.html; https://support.apple.com/kb/HT206224; http://lists.apple.com/archives/security-announce/2016/Mar/msg00008.html
CVE: CVE-2016-1177
Published: 2016-04-05
Description: The management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22 and earlier allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-254
References: http://jvn.jp/en/jp/JVN28480773/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000037; https://service.falconsc.com/
CVE: CVE-2016-2000
Published: 2016-04-05
Description: HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889
CVE: CVE-2016-3125
Published: 2016-04-05
Description: The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254, CWE-310
References: http://bugs.proftpd.org/show_bug.cgi?id=4230; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.html
CVE: CVE-2016-3118
Published: 2016-04-06
Description: CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.3 before 8.3.01, and 8.4 before 8.4.01 allows remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160405-01-security-notice-for-ca-api-gateway.aspx; http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160405-01-security-notice-for-ca-api-gateway.aspx
CVE: CVE-2016-3968
Published: 2016-04-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject arbitrary web script or HTML via the (1) ipFamily parameter to corporate/webpages/trafficdiscovery/LiveConnections.jsp; the (2) ipFamily, (3) applicationname, or (4) username parameter to corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp; or the (5) X-Forwarded-For HTTP header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/136561/Sophos-Cyberoam-NG-Series-Cross-Site-Scripting.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5313.php; http://packetstormsecurity.com/files/136561/Sophos-Cyberoam-NG-Series-Cross-Site-Scripting.html
CVE: CVE-2016-3969
Published: 2016-04-06
Description: Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035470; https://kc.mcafee.com/corporate/index?page=content&id=SB10153; http://www.securitytracker.com/id/1035470
CVE: CVE-2015-6312
Published: 2016-04-06
Description: Cisco TelePresence Server 3.1 on 7010, Mobility Services Engine (MSE) 8710, Multiparty Media 310 and 320, and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (device reload) via malformed STUN packets, aka Bug ID CSCuv01348.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-cts2; http://www.securitytracker.com/id/1035500; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-cts2
CVE: CVE-2015-6313
Published: 2016-04-06
Description: Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted HTTP requests that are not followed by an unspecified negotiation, aka Bug ID CSCuv47565.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-cts1; http://www.securitytracker.com/id/1035501; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-cts1
CVE: CVE-2015-7921
Published: 2016-04-06
Description: The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01
CVE: CVE-2016-0871
Published: 2016-04-06
Description: Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-061-03; https://ics-cert.us-cert.gov/advisories/ICSA-16-061-03
CVE: CVE-2016-1169
Published: 2016-04-06
Description: Cross-site scripting (XSS) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55801246/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000044; https://hiniarata.jp/news/archives/55
CVE: CVE-2016-1170
Published: 2016-04-06
Description: Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of administrators.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN55801246/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000045; https://hiniarata.jp/news/archives/55