deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5395
Published: 2017-09-20
Description: Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/07/10/9; https://github.com/inverse-inc/sogo/commit/582baf2960969c73f98643e46cfb49432c30b711; https://lists.debian.org/debian-lts/2016/05/msg00197.html
CVE: CVE-2015-5608
Published: 2017-09-20
Description: Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/76496; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-open-redirect.html; http://www.securityfocus.com/bid/76496
CVE: CVE-2015-6673
Published: 2017-09-20
Description: Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2015/08/25/9; https://bugzilla.redhat.com/show_bug.cgi?id=1251749; https://lists.debian.org/debian-lts-announce/2019/12/msg00017.html
CVE: CVE-2015-7347
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132286/ZCMS-1.1-Cross-Site-Scripting-SQL-Injection.html; https://www.exploit-db.com/exploits/37272/; http://packetstormsecurity.com/files/132286/ZCMS-1.1-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2017-14595
Published: 2017-09-20
Description: In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
CVSS Score: 3.7 (LOW)
References: http://www.securityfocus.com/bid/100900; http://www.securitytracker.com/id/1039407; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-information-disclosure
CVE: CVE-2017-14596
Published: 2017-09-20
Description: In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90
References: http://www.securityfocus.com/bid/100898; http://www.securitytracker.com/id/1039407; https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
CVE: CVE-2017-14609
Published: 2017-09-20
Description: The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by bearerbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://redmine.kannel.org/issues/771; https://redmine.kannel.org/issues/771
CVE: CVE-2017-14610
Published: 2017-09-20
Description: bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://bugs.bareos.org/view.php?id=847; https://bugs.bareos.org/view.php?id=847
CVE: CVE-2015-9231
Published: 2017-09-20
Description: iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/gnachman/iTerm2/commit/33ccaf61e34ef32ffc9d6b2be5dd218f6bb55f51; https://github.com/gnachman/iTerm2/commit/e4eb1063529deb575b75b396138d41554428d522; https://gitlab.com/gnachman/iterm2/issues/3688
CVE: CVE-2017-14615
Published: 2017-09-20
Description: An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As a side effect, no further events will be visible in the Traffic Monitor until the device is restarted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2017/Sep/22; https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US; https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia
CVE: CVE-2017-14616
Published: 2017-09-20
Description: An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/archive/1/540427; https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia; http://www.securityfocus.com/archive/1/540427
CVE: CVE-2017-14617
Published: 2017-09-20
Description: In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://bugs.freedesktop.org/show_bug.cgi?id=102854; https://bugs.freedesktop.org/show_bug.cgi?id=102854
CVE: CVE-2017-14618
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.phpmyfaq.de/security/advisory-2017-10-19; https://packetstormsecurity.com/files/144280/phpMyFAQ-2.9.8-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/42761/
CVE: CVE-2017-14619
Published: 2017-09-20
Description: Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.phpmyfaq.de/security/advisory-2017-10-19; https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86; https://packetstormsecurity.com/files/144603/phpMyFAQ-2.9.8-Cross-Site-Scripting.html
CVE: CVE-2015-9232
Published: 2017-09-20
Description: The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: http://www.securityfocus.com/archive/1/536543; https://community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-modzero-insecure-application-coupling; https://www.modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt
CVE: CVE-2017-14621
Published: 2017-09-20
Description: Portus 2.2.0 has XSS via the Team field, related to typeahead.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/SUSE/Portus/pull/1425; https://github.com/SUSE/Portus/pull/1425
CVE: CVE-2017-14623
Published: 2017-09-20
Description: In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/go-ldap/ldap/commit/95ede1266b237bf8e9aa5dce0b3250e51bfefe66; https://github.com/go-ldap/ldap/pull/126; https://github.com/go-ldap/ldap/commit/95ede1266b237bf8e9aa5dce0b3250e51bfefe66
CVE: CVE-2017-12214
Published: 2017-09-21
Description: A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to the OAMP and sending a crafted HTTP request. A successful exploit could allow the attacker to gain administrator privileges. The attacker must successfully authenticate to the system to exploit this vulnerability. This vulnerability affects Cisco Unified Customer Voice Portal (CVP) running software release 10.5, 11.0, or 11.5. Cisco Bug IDs: CSCve92752.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-20
References: http://www.securityfocus.com/bid/100931; http://www.securitytracker.com/id/1039411; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cvp
CVE: CVE-2017-12215
Published: 2017-09-21
Description: A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance could allow an unauthenticated, remote attacker to cause an affected device to run out of memory and stop scanning and forwarding email messages. When system memory is depleted, it can cause the filtering process to crash, resulting in a denial of service (DoS) condition on the device. This vulnerability affects software version 9.0 through the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. Cisco Bug IDs: CSCvd29354.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100920; http://www.securitytracker.com/id/1039414; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-esa
CVE: CVE-2017-12219
Published: 2017-09-21
Description: A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to the inability to handle many large IP fragments for reassembly in a short duration. An attacker could exploit this vulnerability by sending a crafted stream of IP fragments to the targeted device. An exploit could allow the attacker to cause a DoS condition when the device unexpectedly reloads. Cisco Bug IDs: CSCve82586.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/100926; http://www.securitytracker.com/id/1039413; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-spa
CVE: CVE-2017-12248
Published: 2017-09-21
Description: A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by persuading a user to click a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve76835.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100921; http://www.securitytracker.com/id/1039408; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cuic
CVE: CVE-2017-12250
Published: 2017-09-21
Description: A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause an HTTP Application Optimization (AO) related process to restart, causing a partial denial of service (DoS) condition. The vulnerability is due to lack of input validation of user-supplied input parameters within an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request through the targeted device. An exploit could allow the attacker to cause a DoS condition due to a process unexpectedly restarting. The WAAS could drop traffic during the brief time the process is restarting. Cisco Bug IDs: CSCvc63048.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/100928; http://www.securitytracker.com/id/1039415; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-waas
CVE: CVE-2017-12252
Published: 2017-09-21
Description: A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attack, potentially causing a partial impact to device availability, confidentiality, and integrity. The vulnerability is due to the application loading a malicious copy of a specific, nondefined DLL file instead of the DLL file it was expecting. An attacker could exploit this vulnerability by placing an affected DLL within the search path of the host system. An exploit could allow the attacker to load a malicious DLL file into the system, thus partially compromising confidentiality, integrity, and availability on the device. Cisco Bug IDs: CSCve89785.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-426
References: http://www.securityfocus.com/bid/100923; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-findit; http://www.securityfocus.com/bid/100923
CVE: CVE-2017-12253
Published: 2017-09-21
Description: A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCve76872.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/100919; http://www.securitytracker.com/id/1039409; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cuic1
CVE: CVE-2017-12254
Published: 2017-09-21
Description: A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code. An exploit could allow the attacker to execute arbitrary code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve76848, CSCve76856.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100922; http://www.securitytracker.com/id/1039410; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cuic2
CVE: CVE-2017-12255
Published: 2017-09-21
Description: A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI, aka a Restricted Shell Break Vulnerability. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. Cisco Bug IDs: CSCve70762.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100932; http://www.securitytracker.com/id/1039412; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-ucs
CVE: CVE-2017-14624
Published: 2017-09-21
Description: ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100940; https://github.com/ImageMagick/ImageMagick/issues/722; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-14625
Published: 2017-09-21
Description: ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100941; https://github.com/ImageMagick/ImageMagick/issues/721; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-14626
Published: 2017-09-21
Description: ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100943; https://github.com/ImageMagick/ImageMagick/issues/720; https://github.com/ImageMagick/ImageMagick/issues/721
CVE: CVE-2017-6720
Published: 2017-09-21
Description: A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SSH connections. An attacker could exploit this vulnerability by logging in to an affected switch via SSH and sending a malicious SSH message. This vulnerability affects the following Cisco products when SSH is enabled: Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvb48377.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/100933; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-sbms; http://www.securityfocus.com/bid/100933
CVE: CVE-2017-14628
Published: 2017-09-21
Description: In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/pts/sam2p/issues/14; https://github.com/pts/sam2p/issues/14
CVE: CVE-2017-14629
Published: 2017-09-21
Description: In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/pts/sam2p/issues/14; https://github.com/pts/sam2p/issues/14
CVE: CVE-2017-14630
Published: 2017-09-21
Description: In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/pts/sam2p/issues/14; https://github.com/pts/sam2p/issues/14
CVE: CVE-2017-14631
Published: 2017-09-21
Description: In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/pts/sam2p/issues/14; https://github.com/pts/sam2p/issues/14
CVE: CVE-2017-14632
Published: 2017-09-21
Description: Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://gitlab.xiph.org/xiph/vorbis/issues/2328; https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html; https://usn.ubuntu.com/3569-1/
CVE: CVE-2017-14633
Published: 2017-09-21
Description: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://gitlab.xiph.org/xiph/vorbis/issues/2329; https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html; https://lists.debian.org/debian-lts-announce/2019/12/msg00021.html
CVE: CVE-2017-14634
Published: 2017-09-21
Description: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/erikd/libsndfile/issues/318; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE: CVE-2017-14245
Published: 2017-09-21
Description: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/erikd/libsndfile/issues/317; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE: CVE-2017-14246
Published: 2017-09-21
Description: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/erikd/libsndfile/issues/317; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE: CVE-2017-14635
Published: 2017-09-21
Description: In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.debian.org/security/2017/dsa-4021; https://www.otrs.com/security-advisory-2017-04-security-update-otrs-versions/; https://www.debian.org/security/2017/dsa-4021
CVE: CVE-2015-0276
Published: 2017-09-21
Description: Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/10/8; http://www.securityfocus.com/bid/74052; https://kallithea-scm.org/security/cve-2015-0276.html