deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3036
Published: 2015-05-21
Description: Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html; http://packetstormsecurity.com/files/131987/KCodes-NetUSB-Buffer-Overflow.html; http://packetstormsecurity.com/files/133919/NetUSB-Stack-Buffer-Overflow.html
CVE: CVE-2015-0741
Published: 2015-05-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38927; http://www.securityfocus.com/bid/74754; http://www.securitytracker.com/id/1032380
CVE: CVE-2015-0742
Published: 2015-05-21
Description: The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38937; http://www.securityfocus.com/bid/74750; http://www.securitytracker.com/id/1032381
CVE: CVE-2015-3911
Published: 2015-05-21
Description: Huawei E587 Mobile WiFi with firmware before 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (device restart) via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-425408.htm; http://www.securityfocus.com/bid/74434; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-425408.htm
CVE: CVE-2015-3912
Published: 2015-05-21
Description: Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-425435.htm; http://www.securityfocus.com/bid/74397; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-425435.htm
CVE: CVE-2012-1978
Published: 2015-05-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admin/adminprocess.php, (3) add an event via a request to engine/new_event.php, or (4) delete an event via a request to phpagenda/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/80793; http://packetstormsecurity.com/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/bid/74778
CVE: CVE-2015-3647
Published: 2015-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131976/WordPress-WP-Photo-Album-Plus-6.1.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535575/100/0/threaded; http://www.securityfocus.com/bid/74741
CVE: CVE-2015-4018
Published: 2015-05-21
Description: SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/131974/WordPress-FeedWordPress-2015.0426-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/May/75; https://wordpress.org/plugins/feedwordpress/changelog/
CVE: CVE-2015-0746
Published: 2015-05-22
Description: The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38946; http://www.securitytracker.com/id/1032387; http://tools.cisco.com/security/center/viewAlert.x?alertId=38946
CVE: CVE-2015-0915
Published: 2015-05-22
Description: Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN20133698/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000063; http://support.maildealer.jp/announce/150511.php
CVE: CVE-2015-0916
Published: 2015-05-22
Description: SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN18957556/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064; http://www.cacti.net/release_notes_0_8_6f.php
CVE: CVE-2015-0750
Published: 2015-05-23
Description: The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38969; http://tools.cisco.com/security/center/viewAlert.x?alertId=38969
CVE: CVE-2014-2174
Published: 2015-05-25
Description: Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified vectors, aka Bug ID CSCub67651.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tc
CVE: CVE-2015-0713
Published: 2015-05-25
Description: The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40), Cisco TelePresence IP Gateway Series Software, Cisco TelePresence IP VCR Series Software before 3.0(1.27), Cisco TelePresence ISDN Gateway Software before 2.2(1.94), Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45), Cisco TelePresence MSE Supervisor Software before 2.3(1.38), Cisco TelePresence Serial Gateway Series Software before 1.0(1.42), Cisco TelePresence Server Software for Hardware before 3.1(1.98), and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors, aka Bug IDs CSCul55968, CSCur08993, CSCur15803, CSCur15807, CSCur15825, CSCur15832, CSCur15842, CSCur15850, and CSCur15855.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tp; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tp
CVE: CVE-2015-0722
Published: 2015-05-25
Description: The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150513-tc
CVE: CVE-2015-1894
Published: 2015-05-25
Description: Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700768; http://www.securityfocus.com/bid/74441; http://www-01.ibm.com/support/docview.wss?uid=swg21700768
CVE: CVE-2015-1895
Published: 2015-05-25
Description: IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 relies on client-side code to verify authorization, which allows remote attackers to bypass intended access restrictions by modifying the client behavior.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700768; http://www.securityfocus.com/bid/74442; http://www-01.ibm.com/support/docview.wss?uid=swg21700768
CVE: CVE-2015-1896
Published: 2015-05-25
Description: Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700536; http://www.securityfocus.com/bid/74024; https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1093
CVE: CVE-2015-1899
Published: 2015-05-25
Description: IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI37139; http://www-01.ibm.com/support/docview.wss?uid=swg21700066; http://www-01.ibm.com/support/docview.wss?uid=swg1PI37139
CVE: CVE-2015-1909
Published: 2015-05-25
Description: The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary files, and consequently obtain administrative access, via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700754; http://www-01.ibm.com/support/docview.wss?uid=swg21700754
CVE: CVE-2015-1910
Published: 2015-05-25
Description: Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700741; http://www-01.ibm.com/support/docview.wss?uid=swg21700741
CVE: CVE-2015-1911
Published: 2015-05-25
Description: Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700864; http://www.securityfocus.com/bid/74224; http://www-01.ibm.com/support/docview.wss?uid=swg21700864
CVE: CVE-2015-1915
Published: 2015-05-25
Description: The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV72069; http://www-01.ibm.com/support/docview.wss?uid=swg21882571; http://www.securityfocus.com/bid/74193
CVE: CVE-2015-1921
Published: 2015-05-25
Description: Open redirect vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 6.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI38632; http://www-01.ibm.com/support/docview.wss?uid=swg21884060; http://www.securityfocus.com/bid/74705
CVE: CVE-2014-4774
Published: 2015-05-25
Description: Cross-site request forgery (CSRF) vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21701389; http://www-01.ibm.com/support/docview.wss?uid=swg21701389
CVE: CVE-2014-4778
Published: 2015-05-25
Description: IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21701389; http://www-01.ibm.com/support/docview.wss?uid=swg21701389
CVE: CVE-2014-6190
Published: 2015-05-25
Description: The log viewer in IBM Workload Deployer 3.1 before 3.1.0.7 allows remote attackers to obtain sensitive information via a direct request for the URL of a log document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700480; http://www-01.ibm.com/support/docview.wss?uid=swg21700480
CVE: CVE-2014-6192
Published: 2015-05-25
Description: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix10, 6.0.5 before 6.0.5.6, and 6.0.5.5a before 6.0.5.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700252; http://www-01.ibm.com/support/docview.wss?uid=swg21700252
CVE: CVE-2014-8926
Published: 2015-05-25
Description: Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service (CPU consumption or application crash) via a crafted XML query, a different vulnerability than CVE-2014-8927.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21882695; http://www-01.ibm.com/support/docview.wss?uid=swg21882695
CVE: CVE-2014-8927
Published: 2015-05-25
Description: Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service (CPU consumption or application crash) via a crafted XML query, a different vulnerability than CVE-2014-8926.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21882695; http://www-01.ibm.com/support/docview.wss?uid=swg21882695
CVE: CVE-2015-0120
Published: 2015-05-25
Description: Buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700549; http://www-01.ibm.com/support/docview.wss?uid=swg21700549
CVE: CVE-2015-0140
Published: 2015-05-25
Description: An unspecified ActiveX control in IBM SPSS Statistics 22.0 through FP1 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 6.8 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21697746; http://www-01.ibm.com/support/docview.wss?uid=swg21697746
CVE: CVE-2015-0156
Published: 2015-05-25
Description: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT06812; http://www-01.ibm.com/support/docview.wss?uid=swg1JR52420; http://www-01.ibm.com/support/docview.wss?uid=swg21697120
CVE: CVE-2015-0160
Published: 2015-05-25
Description: IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0161
Published: 2015-05-25
Description: SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0168
Published: 2015-05-25
Description: Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0169
Published: 2015-05-25
Description: IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-74
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0170
Published: 2015-05-25
Description: IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0171
Published: 2015-05-25
Description: Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699470; http://www-01.ibm.com/support/docview.wss?uid=swg21699470
CVE: CVE-2015-0180
Published: 2015-05-25
Description: The Connector Migration Tool in IBM InfoSphere Information Server 8.1 through 11.3 allows remote authenticated users to bypass intended restrictions on job creation and modification via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51665; http://www-01.ibm.com/support/docview.wss?uid=swg21697306; http://www-01.ibm.com/support/docview.wss?uid=swg1JR51665
CVE: CVE-2015-2120
Published: 2015-05-25
Description: Unspecified vulnerability in HP SiteScope 11.1x before 11.13, 11.2x before 11.24.391, and 11.3x before 11.30.521 allows remote authenticated users to gain privileges via unknown vectors, aka ZDI-CAN-2567.
CVSS Score: 8.7 (HIGH)
References: http://www.securityfocus.com/bid/74801; http://www.zerodayinitiative.com/advisories/ZDI-15-239; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04688784
CVE: CVE-2015-2122
Published: 2015-05-25
Description: The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/74588; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04657823; http://www.securityfocus.com/bid/74588
CVE: CVE-2015-2110
Published: 2015-05-25
Description: Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04594015; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04594015
CVE: CVE-2015-2118
Published: 2015-05-25
Description: Unspecified vulnerability in the Secure Pull Print and Security Pull Print components in HP Access Control (AC) Software 12.x through 14.x before 14.1.2 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04649315; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04649315
CVE: CVE-2015-2121
Published: 2015-05-25
Description: HP Network Virtualization for LoadRunner and Performance Center 8.61 and 11.52 allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController component, aka ZDI-CAN-2569.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/74583; http://zerodayinitiative.com/advisories/ZDI-15-192/; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04657310
CVE: CVE-2015-2123
Published: 2015-05-25
Description: Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand access.
CVSS Score: 9.0 (HIGH)
References: http://www.securityfocus.com/bid/74819; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04683599; http://www.securityfocus.com/bid/74819
CVE: CVE-2015-2945
Published: 2015-05-25
Description: mt-phpincgi.php in Hajime Fujimoto mt-phpincgi before 2015-05-15 does not properly restrict URLs, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted request, as exploited in the wild in May 2015.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN64459670/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000067; http://www.h-fj.com/blog/archives/2015/05/15-112843.php