deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5637
Published: 2015-09-20
Description: The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN19948778/995707/index.html; http://jvn.jp/en/jp/JVN19948778/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000135
CVE: CVE-2014-9227
Published: 2015-09-20
Description: Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/bid/75203; http://www.securitytracker.com/id/1032616; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150617_00
CVE: CVE-2014-9228
Published: 2015-09-20
Description: sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutdown) by triggering an unspecified deadlock condition.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75202; http://www.securitytracker.com/id/1032616; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150617_00
CVE: CVE-2014-9229
Published: 2015-09-20
Description: Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/75204; http://www.securitytracker.com/id/1032616; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150617_00
CVE: CVE-2015-5689
Published: 2015-09-20
Description: ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/76498; http://www.securitytracker.com/id/1033577; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150902_00
CVE: CVE-2015-5690
Published: 2015-09-20
Description: The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/76725; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-5691
Published: 2015-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against admin_messages.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/76728; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-5692
Published: 2015-09-20
Description: admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make this a setuid-root file.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/76726; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-5693
Published: 2015-09-20
Description: The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
CVSS Score: 7.9 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/76731; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-6547
Published: 2015-09-20
Description: The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/76730; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-6548
Published: 2015-09-20
Description: Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/76729; http://www.securitytracker.com/id/1033625; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00
CVE: CVE-2015-2864
Published: 2015-09-21
Description: Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/101500; http://www.retrospect.com/support/kb/cve_2015_2864; http://www.securityfocus.com/bid/75201
CVE: CVE-2015-2914
Published: 2015-09-21
Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a fixed source-port number in outbound DNS queries performed on behalf of any device, which makes it easier for remote attackers to spoof responses by using this number for the destination port, a different vulnerability than CVE-2015-7296.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/906576; http://www.kb.cert.org/vuls/id/906576
CVE: CVE-2015-2915
Published: 2015-09-21
Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M have a default password of admin for the admin account, which allows remote attackers to obtain web-management access by leveraging the ability to authenticate from the intranet.
CVSS Score: 7.3 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/906576; http://www.kb.cert.org/vuls/id/906576
CVE: CVE-2015-2916
Published: 2015-09-21
Description: Cross-site request forgery (CSRF) vulnerability on Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/906576; http://www.kb.cert.org/vuls/id/906576
CVE: CVE-2015-2917
Published: 2015-09-21
Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/906576; http://www.kb.cert.org/vuls/id/906576
CVE: CVE-2015-5991
Published: 2015-09-21
Description: Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/525276; http://www.kb.cert.org/vuls/id/525276
CVE: CVE-2015-5992
Published: 2015-09-21
Description: Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to inject arbitrary web script or HTML via the ssid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/525276; http://www.kb.cert.org/vuls/id/525276
CVE: CVE-2015-5993
Published: 2015-09-21
Description: Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/525276; http://www.kb.cert.org/vuls/id/525276
CVE: CVE-2015-7296
Published: 2015-09-21
Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/906576; http://www.kb.cert.org/vuls/id/906576
CVE: CVE-2015-5603
Published: 2015-09-21
Description: The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html; http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template; http://www.securityfocus.com/archive/1/536374/100/0/threaded
CVE: CVE-2015-6238
Published: 2015-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4) ga_downloads, or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/google-analyticator/changelog/; https://wpvulndb.com/vulnerabilities/8159; https://www.netsparker.com/cve-2015-6238-multiple-xss-vulnerabilities-in-google-analyticator/
CVE: CVE-2015-6749
Published: 2015-09-21
Description: Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165555.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166424.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00013.html
CVE: CVE-2015-6923
Published: 2015-09-21
Description: The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/133620/VBox-Satellite-Express-Arbitrary-Write-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Sep/72; http://www.securityfocus.com/archive/1/536491/100/0/threaded
CVE: CVE-2015-6938
Published: 2015-09-21
Description: Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html
CVE: CVE-2015-7303
Published: 2015-09-21
Description: Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.
CVSS Score: 10.0 (HIGH)
References: http://www.zerodayinitiative.com/advisories/ZDI-15-445; http://www.zerodayinitiative.com/advisories/ZDI-15-445
CVE: CVE-2015-7304
Published: 2015-09-21
Description: Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2569243; https://www.drupal.org/node/2569587; https://www.drupal.org/node/2569243
CVE: CVE-2015-7305
Published: 2015-09-21
Description: The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2569621; https://www.drupal.org/node/2569631; https://www.drupal.org/node/2569621
CVE: CVE-2015-7306
Published: 2015-09-21
Description: The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://www.drupal.org/node/2569111; https://www.drupal.org/node/2569599; https://www.drupal.org/node/2569111
CVE: CVE-2015-7307
Published: 2015-09-21
Description: Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/node/2569111; https://www.drupal.org/node/2569599; https://www.drupal.org/node/2569111
CVE: CVE-2015-5567
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5579.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5568
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5570
Published: 2015-09-22
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5571
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.  NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5572
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5573
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5574
Published: 2015-09-22
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5575
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5576
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5577
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
CVE: CVE-2015-5578
Published: 2015-09-22
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html