deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6246
Published: 2015-08-24
Description: The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6247
Published: 2015-08-24
Description: The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6248
Published: 2015-08-24
Description: The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6249
Published: 2015-08-24
Description: The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-3269
Published: 2015-08-25
Description: Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0978&w=2; http://www.securityfocus.com/archive/1/536266/100/0/threaded; http://www.securityfocus.com/bid/76394
CVE: CVE-2015-5785
Published: 2015-08-25
Description: Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00004.html; http://www.securitytracker.com/id/1033346; https://support.apple.com/HT205046
CVE: CVE-2015-5786
Published: 2015-08-25
Description: Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Aug/msg00004.html; http://www.securitytracker.com/id/1033346; https://support.apple.com/HT205046
CVE: CVE-2015-6262
Published: 2015-08-25
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Prime Infrastructure 1.2(0.103) and 2.0(0.0) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCum49054 and CSCum49059.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40652; http://www.securitytracker.com/id/1033364; http://tools.cisco.com/security/center/viewAlert.x?alertId=40652
CVE: CVE-2012-2150
Published: 2015-08-25
Description: xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generated image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163690.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164180.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164189.html
CVE: CVE-2015-4020
Published: 2015-08-25
Description: RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blog.rubygems.org/2015/06/08/2.2.5-released.html; http://blog.rubygems.org/2015/06/08/2.4.8-released.html; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2015-5161
Published: 2015-08-25
Description: The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
CVSS Score: 6.8 (MEDIUM)
References: http://framework.zend.com/security/advisory/ZF2015-06; http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html
CVE: CVE-2015-5949
Published: 2015-08-25
Description: VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00040.html; http://packetstormsecurity.com/files/133266/VLC-2.2.1-Arbitrary-Pointer-Dereference.html; http://www.debian.org/security/2015/dsa-3342
CVE: CVE-2015-6261
Published: 2015-08-26
Description: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access (MRA) role and establishing a TFTP session, aka Bug ID CSCuv78531.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40620; http://www.securitytracker.com/id/1033379; http://tools.cisco.com/security/center/viewAlert.x?alertId=40620
CVE: CVE-2015-5409
Published: 2015-08-26
Description: Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033378; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04765115; http://www.securitytracker.com/id/1033378
CVE: CVE-2015-5410
Published: 2015-08-26
Description: HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to execute arbitrary code or cause a denial of service via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securitytracker.com/id/1033378; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04765115; http://www.securitytracker.com/id/1033378
CVE: CVE-2015-5411
Published: 2015-08-26
Description: HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033378; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04765115; http://www.securitytracker.com/id/1033378
CVE: CVE-2015-5412
Published: 2015-08-26
Description: Cross-site request forgery (CSRF) vulnerability in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www.securitytracker.com/id/1033378; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04765115; http://www.securitytracker.com/id/1033378
CVE: CVE-2015-5413
Published: 2015-08-26
Description: HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to gain privileges and obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.securitytracker.com/id/1033378; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04765115; http://www.securitytracker.com/id/1033378
CVE: CVE-2013-7424
Published: 2015-08-26
Description: The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-17
References: http://rhn.redhat.com/errata/RHSA-2015-1627.html; http://www.openwall.com/lists/oss-security/2015/01/29/21; http://www.securityfocus.com/bid/72710
CVE: CVE-2015-3158
Published: 2015-08-26
Description: The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-1669.html; http://rhn.redhat.com/errata/RHSA-2015-1670.html; http://rhn.redhat.com/errata/RHSA-2015-1671.html
CVE: CVE-2015-3221
Published: 2015-08-26
Description: OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.html; http://rhn.redhat.com/errata/RHSA-2015-1680.html; http://www.securityfocus.com/bid/75368
CVE: CVE-2015-3239
Published: 2015-08-26
Description: Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.
CVSS Score: 3.3 (LOW)
CWE: CWE-189
References: http://git.savannah.gnu.org/cgit/libunwind.git/commit/?id=396b6c7ab737e2bff244d640601c436a26260ca1; http://rhn.redhat.com/errata/RHSA-2015-1675.html; http://rhn.redhat.com/errata/RHSA-2015-1768.html
CVE: CVE-2015-4037
Published: 2015-08-26
Description: The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
CVSS Score: 1.9 (LOW)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160058.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160414.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html
CVE: CVE-2015-4173
Published: 2015-08-26
Description: Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-428
References: http://packetstormsecurity.com/files/133302/Dell-SonicWall-NetExtender-7.5.215-Privilege-Escalation.html; http://www.securityfocus.com/archive/1/536303/100/0/threaded; http://www.securitytracker.com/id/1033417
CVE: CVE-2015-2139
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5403.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-2140
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-5402
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local users to gain privileges, and consequently obtain sensitive information, modify data, or cause a denial of service, via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-5403
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-2139.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-5404
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-5405
Published: 2015-08-27
Description: HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04762744
CVE: CVE-2015-5427
Published: 2015-08-27
Description: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5428 and CVE-2015-5429.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5428
Published: 2015-08-27
Description: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5429
Published: 2015-08-27
Description: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5428.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5430
Published: 2015-08-27
Description: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5431
Published: 2015-08-27
Description: HP Matrix Operating Environment before 7.5.0 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5432
Published: 2015-08-27
Description: HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774021; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-5433
Published: 2015-08-27
Description: HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774021; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04774019
CVE: CVE-2015-6265
Published: 2015-08-27
Description: The CLI in Cisco Application Control Engine (ACE) 4700 A5 3.0 and earlier allows local users to bypass intended access restrictions, and read or write to files, by entering an unspecified CLI command with a crafted file as this command's input, aka Bug ID CSCur23662.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40666; http://www.securityfocus.com/bid/76491; http://www.securitytracker.com/id/1033381
CVE: CVE-2015-5367
Published: 2015-08-27
Description: The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/76171; http://www.securitytracker.com/id/1033414; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-446601.htm
CVE: CVE-2015-5368
Published: 2015-08-27
Description: The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service, or execute arbitrary code, via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/76176; http://www.securitytracker.com/id/1033414; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-446601.htm
CVE: CVE-2015-2987
Published: 2015-08-28
Description: Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an original length smaller than 128 bits.
CVSS Score: 2.6 (LOW)
CWE: CWE-17
References: http://jvn.jp/en/jp/JVN91474878/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000119; http://type74.org/edman5-1.php
CVE: CVE-2015-6266
Published: 2015-08-28
Description: The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40691; http://www.securitytracker.com/id/1033405; http://tools.cisco.com/security/center/viewAlert.x?alertId=40691
CVE: CVE-2014-9651
Published: 2015-08-28
Description: Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/msg00000.html; http://lists.nongnu.org/archive/html/chicken-users/2015-01/msg00048.html; http://www.securityfocus.com/bid/72011
CVE: CVE-2015-1171
Published: 2015-08-28
Description: Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/129992/simeditor-overflow.txt; https://osandamalith.wordpress.com/2015/01/16/sim-editor-stack-based-buffer-overflow/; https://www.youtube.com/watch?v=tljbFpYtDTk
CVE: CVE-2015-6267
Published: 2015-08-29
Description: Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted L2TP packet, aka Bug IDs CSCsw95722 and CSCsw95496.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40684; http://www.securitytracker.com/id/1033410; http://tools.cisco.com/security/center/viewAlert.x?alertId=40684