deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1925
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75449; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1929
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75451; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1930
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75452; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1938
Published: 2015-06-30
Description: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1986.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75444; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1941
Published: 2015-06-30
Description: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to read arbitrary files via a crafted TCP packet to an unspecified port.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75446; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1942
Published: 2015-06-30
Description: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75450; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1948
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75453; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1949
Published: 2015-06-30
Description: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75459; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1953
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75456; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1954
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75448; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1962
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75454; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1963
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75455; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1964
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75457; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1965
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1964.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75458; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1986
Published: 2015-06-30
Description: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75461; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-2966
Published: 2015-06-30
Description: Directory traversal vulnerability in the Droidware UK Explorer+ File Manager application before 2.3.3 for Android allows remote attackers to write to arbitrary files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN77386811/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000093; http://jvn.jp/en/jp/JVN77386811/index.html
CVE: CVE-2015-4226
Published: 2015-06-30
Description: The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39554; http://www.securityfocus.com/bid/75471; http://www.securitytracker.com/id/1032748
CVE: CVE-2015-1950
Published: 2015-07-01
Description: IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020740; http://www-01.ibm.com/support/docview.wss?uid=swg1IT08926; http://www.securityfocus.com/bid/75102
CVE: CVE-2015-1951
Published: 2015-07-01
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959613; http://www.securityfocus.com/bid/75340; http://www-01.ibm.com/support/docview.wss?uid=swg21959613
CVE: CVE-2015-1967
Published: 2015-07-01
Description: MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960491; http://www.securitytracker.com/id/1032772; http://www-01.ibm.com/support/docview.wss?uid=swg21960491
CVE: CVE-2014-1750
Published: 2015-07-01
Description: Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html.  NOTE: this was originally reported as a cross-site scripting (XSS) vulnerability, but this may be inaccurate.
CVSS Score: 5.8 (MEDIUM)
References: http://seclists.org/oss-sec/2014/q1/173; http://seclists.org/oss-sec/2014/q1/181; http://www.securityfocus.com/bid/65226
CVE: CVE-2014-1836
Published: 2015-07-01
Description: Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://community.impresscms.org/modules/smartsection/item.php?itemid=675; http://osvdb.org/show/osvdb/102770; http://seclists.org/fulldisclosure/2014/Feb/14
CVE: CVE-2015-0848
Published: 2015-07-01
Description: Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160668.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168507.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165547.html
CVE: CVE-2015-1330
Published: 2015-07-01
Description: unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://metadata.ftp-master.debian.org/changelogs//main/u/unattended-upgrades/unattended-upgrades_0.86.1_changelog; http://www.debian.org/security/2015/dsa-3297; http://www.securitytracker.com/id/1032738
CVE: CVE-2015-2141
Published: 2015-07-01
Description: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2015-07/msg00047.html; http://sourceforge.net/p/cryptopp/code/542/; http://www.debian.org/security/2015/dsa-3296
CVE: CVE-2015-3164
Published: 2015-07-01
Description: The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.freedesktop.org/archives/wayland-devel/2015-June/022548.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00044.html; http://www.securityfocus.com/bid/75535
CVE: CVE-2015-3204
Published: 2015-07-01
Description: libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2015-1154.html; http://www.securityfocus.com/bid/75392; https://libreswan.org/security/CVE-2015-3204/CVE-2015-3204.txt
CVE: CVE-2015-4588
Published: 2015-07-01
Description: Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160668.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00051.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00053.html
CVE: CVE-2015-4695
Published: 2015-07-01
Description: meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162569.html; http://lists.opensuse.org/opensuse-updates/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1917.html
CVE: CVE-2015-4696
Published: 2015-07-01
Description: Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162569.html; http://lists.opensuse.org/opensuse-updates/2015-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2015-1917.html
CVE: CVE-2015-5353
Published: 2015-07-01
Description: Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tab parameter to admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txt; http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html; http://www.securityfocus.com/archive/1/535876/100/0/threaded
CVE: CVE-2015-5354
Published: 2015-07-01
Description: Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-601
References: http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txt; http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html; http://www.securityfocus.com/archive/1/535876/100/0/threaded
CVE: CVE-2015-5355
Published: 2015-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132481/GetSimple-CMS-5.7.3.1-Cross-Site-Scripting.html; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1046; https://github.com/GetSimpleCMS/GetSimpleCMS/releases/tag/v3.3.6
CVE: CVE-2015-5356
Published: 2015-07-01
Description: Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/commit/cb1845743bd11ba74a49b6b522c080df86a17d51; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1059; https://github.com/GetSimpleCMS/GetSimpleCMS/releases/tag/v3.3.6
CVE: CVE-2015-4233
Published: 2015-07-02
Description: SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39570; http://www.securityfocus.com/bid/75500; http://www.securitytracker.com/id/1032766
CVE: CVE-2015-3157
Published: 2015-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-3443
Published: 2015-07-02
Description: Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jun/78; http://thycotic.com/products/secret-server/resources/advisories/thy-ss-004/; http://www.csnc.ch/misc/files/advisories/CVE-2015-3443_Thycotic_Secret_Server_XSS.TXT
CVE: CVE-2015-4228
Published: 2015-07-02
Description: Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39556; http://tools.cisco.com/security/center/viewAlert.x?alertId=39556
CVE: CVE-2015-4238
Published: 2015-07-02
Description: The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39611; http://www.securitytracker.com/id/1032776; http://tools.cisco.com/security/center/viewAlert.x?alertId=39611
CVE: CVE-2015-5365
Published: 2015-07-02
Description: Cross-site scripting (XSS) vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132418/Zurmo-CRM-3.0.2-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/75545; http://packetstormsecurity.com/files/132418/Zurmo-CRM-3.0.2-Cross-Site-Scripting.html
CVE: CVE-2015-0192
Published: 2015-07-02
Description: Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
CVE: CVE-2015-1914
Published: 2015-07-02
Description: IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
CVE: CVE-2015-1916
Published: 2015-07-02
Description: Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TLS and the Secure Socket Extension provider.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV72245; http://www-01.ibm.com/support/docview.wss?uid=swg21883640; http://www.securitytracker.com/id/1032779
CVE: CVE-2015-3202
Published: 2015-07-02
Description: fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html
CVE: CVE-2015-3658
Published: 2015-07-03
Description: The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
CVE: CVE-2015-3659
Published: 2015-07-03
Description: The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html