deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2194
Published: 2015-03-03
Description: Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion_save action, then accessing it via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/130397/WordPress-Fusion-3.1-Arbitrary-File-Upload.html; http://www.securityfocus.com/bid/75341; https://wpvulndb.com/vulnerabilities/7795
CVE: CVE-2015-2195
Published: 2015-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/534773/100/0/threaded; http://www.securityfocus.com/archive/1/534773/100/0/threaded
CVE: CVE-2015-2196
Published: 2015-03-03
Description: SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/36061; http://www.exploit-db.com/exploits/36061
CVE: CVE-2015-2197
Published: 2015-03-03
Description: Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/72806; https://www.drupal.org/node/2437885; https://www.drupal.org/node/2437905
CVE: CVE-2015-2198
Published: 2015-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/p/beehiveforum/news/2015/02/beehive-forum-145-released/; http://www.exploit-db.com/exploits/36154; http://sourceforge.net/p/beehiveforum/news/2015/02/beehive-forum-145-released/
CVE: CVE-2015-2199
Published: 2015-03-03
Description: Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/118508; http://osvdb.org/show/osvdb/118509; http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html
CVE: CVE-2015-0656
Published: 2015-03-04
Description: Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0656; http://www.securitytracker.com/id/1031827; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0656
CVE: CVE-2015-0933
Published: 2015-03-04
Description: Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/302668; http://www.kb.cert.org/vuls/id/302668
CVE: CVE-2015-0934
Published: 2015-03-04
Description: Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://www.kb.cert.org/vuls/id/302668; http://www.kb.cert.org/vuls/id/302668
CVE: CVE-2014-8617
Published: 2015-03-04
Description: Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Mar/5; http://www.fortiguard.com/advisory/FG-IR-15-005/; http://www.securitytracker.com/id/1031859
CVE: CVE-2015-2209
Published: 2015-03-04
Description: DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2015/Feb/67; http://tetraph.com/security/full-path-disclosure-vulnerability/dlguard-full-path-disclosure-information-leakage-security-vulnerabilities/; http://www.securityfocus.com/bid/72685
CVE: CVE-2015-0891
Published: 2015-03-05
Description: Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN63687798/995638/index.html; http://jvn.jp/en/jp/JVN63687798/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000034
CVE: CVE-2015-0892
Published: 2015-03-05
Description: Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN09871547/995638/index.html; http://jvn.jp/en/jp/JVN09871547/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000035
CVE: CVE-2015-0893
Published: 2015-03-05
Description: Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN91016415/995638/index.html; http://jvn.jp/en/jp/JVN91016415/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000036
CVE: CVE-2015-2214
Published: 2015-03-05
Description: NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130583/NetCat-CMS-5.01-3.12-Full-Path-Disclosure.html; http://seclists.org/fulldisclosure/2015/Mar/8; http://tetraph.com/security/full-path-disclosure-vulnerability/netcat-cms-full-path-disclosure-information-disclosure-security-vulnerabilities/
CVE: CVE-2015-2215
Published: 2015-03-05
Description: Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/bid/72803; https://www.drupal.org/node/2437965; http://www.securityfocus.com/bid/72803
CVE: CVE-2015-2216
Published: 2015-03-05
Description: SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130595/WordPress-Photocrati-Theme-4.x.x-SQL-Injection.html; http://www.exploit-db.com/exploits/36242; http://www.securityfocus.com/bid/74854
CVE: CVE-2014-9688
Published: 2015-03-05
Description: Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
CVSS Score: 7.5 (HIGH)
References: https://wordpress.org/plugins/ninja-forms/changelog/; https://wordpress.org/plugins/ninja-forms/changelog/
CVE: CVE-2015-2218
Published: 2015-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/118510; http://osvdb.org/show/osvdb/118511; http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html
CVE: CVE-2015-2220
Published: 2015-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130369/WordPress-Ninja-Forms-2.8.8-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534687/100/0/threaded; http://www.securityfocus.com/bid/74857
CVE: CVE-2014-2130
Published: 2015-03-06
Description: Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka Bug ID CSCuj83189.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130; http://www.securitytracker.com/id/1031844; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130
CVE: CVE-2015-0598
Published: 2015-03-06
Description: The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0598; http://www.securitytracker.com/id/1031842; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0598
CVE: CVE-2015-0607
Published: 2015-03-06
Description: The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0607; http://tools.cisco.com/security/center/viewAlert.x?alertId=37711; http://www.securityfocus.com/bid/72794
CVE: CVE-2015-0657
Published: 2015-03-06
Description: Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0657; http://www.securitytracker.com/id/1031841; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0657
CVE: CVE-2015-0659
Published: 2015-03-06
Description: The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS allows remote attackers to trigger self-referential adjacencies via a crafted Autonomic Networking (AN) message, aka Bug ID CSCup62157.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0659; http://www.securitytracker.com/id/1031845; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0659
CVE: CVE-2015-0661
Published: 2015-03-06
Description: The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0661; http://www.securitytracker.com/id/1031843; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0661
CVE: CVE-2015-1483
Published: 2015-03-06
Description: Symantec NetBackup OpsCenter 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/72737; http://www.securitytracker.com/id/1031831; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150302_00
CVE: CVE-2015-1637
Published: 2015-03-06
Description: Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://web.archive.org/web/[PII_REDACTED]0028/https://freakattack.com/; http://www.securityfocus.com/bid/72965; http://www.securitytracker.com/id/1031833
CVE: CVE-2014-8891
Published: 2015-03-06
Description: Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00025.html
CVE: CVE-2014-8892
Published: 2015-03-06
Description: Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via unspecified vectors related to the security manager.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00025.html
CVE: CVE-2015-1170
Published: 2015-03-06
Description: The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API calls.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2653&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5091&w=2; http://nvidia.custhelp.com/app/answers/detail/a_id/3634
CVE: CVE-2014-9369
Published: 2015-03-07
Description: Siemens SPC controllers SPC4000, SPC5000, and SPC6000 before 3.6.0 allow remote attackers to cause a denial of service (device restart) via crafted packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-335471.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-335471.pdf
CVE: CVE-2015-0894
Published: 2015-03-07
Description: SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN30832515/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000037; https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/
CVE: CVE-2015-0895
Published: 2015-03-07
Description: Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN87204433/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000038; https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/
CVE: CVE-2015-1594
Published: 2015-03-07
Description: Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.
CVSS Score: 6.9 (MEDIUM)
References: http://www.securitytracker.com/id/1032039; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf; http://www.securitytracker.com/id/1032039
CVE: CVE-2015-1595
Published: 2015-03-07
Description: The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE: CVE-2015-1596
Published: 2015-03-07
Description: The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE: CVE-2015-1597
Published: 2015-03-07
Description: The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE: CVE-2015-1598
Published: 2015-03-07
Description: The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device filesystem.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE: CVE-2015-1599
Published: 2015-03-07
Description: The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf
CVE: CVE-2015-2177
Published: 2015-03-07
Description: Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/72973; http://www.securitytracker.com/id/1032040; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-987029.pdf
CVE: CVE-2015-2235
Published: 2015-03-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-1067.  Reason: This candidate is a duplicate of CVE-2015-1067.  Notes: All CVE users should reference CVE-2015-1067 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-0228
Published: 2015-03-08
Description: The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2015-0099.html; http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
CVE: CVE-2015-2187
Published: 2015-03-08
Description: The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://www.securityfocus.com/bid/72940; http://www.securitytracker.com/id/1031858
CVE: CVE-2015-2188
Published: 2015-03-08
Description: epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://advisories.mageia.org/MGASA-2015-0117.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://www.debian.org/security/2015/dsa-3210
CVE: CVE-2015-2189
Published: 2015-03-08
Description: Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0117.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html