deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0104
Published: 2017-04-24
Description: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694974; http://www.securityfocus.com/bid/97999; http://www-01.ibm.com/support/docview.wss?uid=swg21694974
CVE: CVE-2015-0107
Published: 2017-04-24
Description: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21694974; http://www.securityfocus.com/bid/97998; http://www-01.ibm.com/support/docview.wss?uid=swg21694974
CVE: CVE-2015-1521
Published: 2017-04-24
Description: analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0; https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0
CVE: CVE-2015-1522
Published: 2017-04-24
Description: analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0; https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0
CVE: CVE-2015-8109
Published: 2017-04-24
Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX account credentials that requires knowledge of the time that this account was created, aka a "temporary administrator account vulnerability."
CVSS Score: 7.0 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/98039; https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_SystemUpdate-Insecure-Random-Admin-Password.pdf; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2015-8110
Published: 2017-04-24
Description: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98037; https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2017-8082
Published: 2017-04-24
Description: concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt; https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0; https://twitter.com/insecurity/status/[PII_REDACTED]46215425
CVE: CVE-2017-7852
Published: 2017-04-24
Description: D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without knowing the credentials. An attacker can host a malicious Flash file that can retrieve Live Feeds or information from the victim's DCS series Camera, add new admin users, or make other changes to the device. Known affected devices are DCS-933L with firmware before 1.13.05, DCS-5030L, DCS-5020L, DCS-2530L, DCS-2630L, DCS-930L, DCS-932L, and DCS-932LB1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.qualys.com/2017/02/22/qsa-2017-02-22/qsa-2017-02-22.pdf; https://www.qualys.com/2017/02/22/qsa-2017-02-22/qsa-2017-02-22.pdf
CVE: CVE-2017-7944
Published: 2017-04-24
Description: XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97978; https://tsublogs.wordpress.com/2017/04/24/xoops-core-2-5-8-1-install-db-cross-site-scripting/; http://www.securityfocus.com/bid/97978
CVE: CVE-2017-8085
Published: 2017-04-24
Description: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.exponentcms.org/news/patch-5-released-for-v2-4-1-to-fix-a-few-critical-issues; http://www.securityfocus.com/bid/98043; https://github.com/exponentcms/exponent-cms/commit/0b2241ff1c7d86376fa260c5d4c1714f6cef9c0f
CVE: CVE-2017-2312
Published: 2017-04-24
Description: On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a small amount of the memory allocated for the rpd (routing protocol daemon) process. Over time, repeatedly receiving this type of LDP packet(s) will cause the memory to exhaust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without restarting the rpd process. This issue affects Junos OS based devices with either IPv4 or IPv6 LDP enabled via the [protocols ldp] configuration (the native IPv6 support for LDP is available in Junos OS 16.1 and higher). The interface on which the packet arrives needs to have LDP enabled. The affected Junos versions are: 13.3 prior to 13.3R10; 14.1 prior to 14.1R8; 14.2 prior to 14.2R7-S6 or 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and all subsequent releases have a resolution for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/97611; http://www.securitytracker.com/id/1038252; https://kb.juniper.net/JSA10777
CVE: CVE-2017-2313
Published: 2017-04-24
Description: Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process daemon) crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition. The affected Junos OS versions are: 15.1 prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D78, 15.1X49-D80; 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4; 16.2 prior to 16.2R1-S3, 16.2R2; Releases prior to Junos OS 15.1 are unaffected by this vulnerability. 17.1R1, 17.2R1, and all subsequent releases have a resolution for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97606; http://www.securitytracker.com/id/1038257; https://kb.juniper.net/JSA10778
CVE: CVE-2017-2315
Published: 2017-04-24
Description: On Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, a vulnerability in IPv6 processing has been discovered that may allow a specially crafted IPv6 Neighbor Discovery (ND) packet destined to an EX Series Ethernet Switch to cause a slow memory leak. A malicious network-based packet flood of these crafted IPv6 NDP packets may eventually lead to resource exhaustion and a denial of service. The affected Junos OS versions are: 12.3 prior to 12.3R12-S4, 12.3R13; 13.3 prior to 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior ro 14.1X53-D12, 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R6-S4, 14.2R7-S6, 14.2R8; 15.1 prior to 15.1R5; 16.1 before 16.1R3; 16.2 before 16.2R1-S3, 16.2R2. 17.1R1 and all subsequent releases have a resolution for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/97615; http://www.securitytracker.com/id/1038253; https://kb.juniper.net/JSA10781
CVE: CVE-2017-2316
Published: 2017-04-24
Description: A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to cause a buffer overflow leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97601; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97601
CVE: CVE-2017-2317
Published: 2017-04-24
Description: A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause denials of services to underlying database tables leading to potential information disclosure, modification of system states, and partial to full denial of services relying upon data modified by an attacker.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97652; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97652
CVE: CVE-2017-2318
Published: 2017-04-24
Description: A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to read log files which will compromise the integrity of the system, or provide elevation of privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97660; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97660
CVE: CVE-2017-2319
Published: 2017-04-24
Description: A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authentic end users and systems as a result.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/97659; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97659
CVE: CVE-2017-2320
Published: 2017-04-24
Description: A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97687; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97687
CVE: CVE-2017-2321
Published: 2017-04-24
Description: A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various system services partial to full denials of services, modification of system states and files, and potential disclosure of sensitive information which may assist the attacker in further attacks on the system through the use of multiple attack vectors, including man-in-the-middle attacks, file injections, and malicious execution of commands causing out of bound memory conditions leading to other attacks.
CVSS Score: 8.6 (HIGH)
References: http://www.securityfocus.com/bid/97693; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97693
CVE: CVE-2017-2323
Published: 2017-04-24
Description: A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker crafting packets destined to the device to cause a persistent denial of service to the path computation server service.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/97600; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97600
CVE: CVE-2017-2324
Published: 2017-04-24
Description: A command injection vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to cause a denial of service condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: http://www.securityfocus.com/bid/97604; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97604
CVE: CVE-2017-2325
Published: 2017-04-24
Description: A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to cause a buffer overflow leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97602; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97602
CVE: CVE-2017-2326
Published: 2017-04-24
Description: An information disclosure vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, authenticated, network-based attacker to replicate the underlying Junos OS VM and all data it maintains to their local system for future analysis.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97691; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97691
CVE: CVE-2017-2327
Published: 2017-04-24
Description: A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to consume large amounts of system resources leading to a cascading denial of services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/97609; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97609
CVE: CVE-2017-2328
Published: 2017-04-24
Description: An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, authenticated, user to elevate their permissions through reading unprivileged information stored in the NorthStar controller.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97617; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97617
CVE: CVE-2017-2329
Published: 2017-04-24
Description: An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, authenticated, user to execute certain specific unprivileged system files capable of causing widespread denials of system services.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/97614; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97614
CVE: CVE-2017-2330
Published: 2017-04-24
Description: A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, local user, to create a fork bomb scenario, also known as a rabbit virus, or wabbit, which will create processes that replicate themselves, until all resources are consumed on the system, leading to a denial of service to the entire system until it is restarted. Continued attacks by an unauthenticated, local user, can lead to persistent denials of services.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-834
References: http://www.securityfocus.com/bid/97618; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97618
CVE: CVE-2017-2331
Published: 2017-04-24
Description: A firewall bypass vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to bypass firewall policies, leading to authentication bypass methods, information disclosure, modification of system files, and denials of service.
CVSS Score: 7.3 (HIGH)
References: http://www.securityfocus.com/bid/97619; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97619
CVE: CVE-2017-2332
Published: 2017-04-24
Description: An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious, network based, unauthenticated attacker to perform privileged actions to gain complete control over the environment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/97624; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97624
CVE: CVE-2017-2333
Published: 2017-04-24
Description: A persistent denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious, network-based, authenticated attacker to consume enough system resources to cause a persistent denial of service by visiting certain specific URLs on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/97608; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97608
CVE: CVE-2017-2334
Published: 2017-04-24
Description: An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted, and subsequently gain complete control of the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97616; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97616
CVE: CVE-2017-2340
Published: 2017-04-24
Description: On Juniper Networks Junos OS 15.1 releases from 15.1R3 to 15.1R4, 16.1 prior to 16.1R3, on M/MX platforms where Enhanced Subscriber Management for DHCPv6 subscribers is configured, a vulnerability in processing IPv6 ND packets originating from subscribers and destined to M/MX series routers can result in a PFE (Packet Forwarding Engine) hang or crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97607; http://www.securitytracker.com/id/1038254; https://kb.juniper.net/JSA10786
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-24
Description: Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch, which is the feature responsible for the OpenFlow communication. Version: OpenDaylight versions 3.3 (Lithium-SR3), 3.4 (Lithium-SR4), 4.0 (Beryllium), 4.1 (Beryllium-SR1), 4.2 (Beryllium-SR2), and 4.4 (Beryllium-SR4) are affected by this flaw. Java version is openjdk version 1.8.0_91.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf; https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-24
Description: Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf feature contains this flaw. Version: OpenDaylight 4.0 is affected by this flaw.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf; https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-24
Description: Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf; https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-24
Description: StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf; https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-24
Description: DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
CVSS Score: 7.5 (HIGH)
References: https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf; https://aaltodoc.aalto.fi/bitstream/handle/123456789/21584/master_Bidaj_Andi_2016.pdf
CVE: CVE-2015-7245
Published: 2017-04-24
Description: Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html; http://seclists.org/fulldisclosure/2016/Feb/24; https://www.exploit-db.com/exploits/39409/
CVE: CVE-2015-7246
Published: 2017-04-24
Description: D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html; http://seclists.org/fulldisclosure/2016/Feb/24; https://www.exploit-db.com/exploits/39409/
CVE: CVE-2015-7247
Published: 2017-04-24
Description: D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html; http://seclists.org/fulldisclosure/2016/Feb/24; https://www.exploit-db.com/exploits/39409/