deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7744
Published: 2016-01-22
Description: wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
CVSS Score: 5.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00016.html; http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html
CVE: CVE-2016-1570
Published: 2016-01-22
Description: The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3519; http://www.securitytracker.com/id/1034744; http://xenbits.xen.org/xsa/advisory-167.html
CVE: CVE-2016-1571
Published: 2016-01-22
Description: The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-17
References: http://support.citrix.com/article/CTX205496; http://www.debian.org/security/2016/dsa-3519; http://www.securitytracker.com/id/1034745
CVE: CVE-2016-1572
Published: 2016-01-22
Description: mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177359.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177396.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00091.html
CVE: CVE-2015-6317
Published: 2016-01-23
Description: Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka Bug ID CSCuu45926.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-ise2; http://www.securitytracker.com/id/1034767; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-ise2
CVE: CVE-2015-7417
Published: 2016-01-23
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI49272; http://www-01.ibm.com/support/docview.wss?uid=swg21974520; http://www.securityfocus.com/bid/81738
CVE: CVE-2016-1612
Published: 2016-01-25
Description: The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1613
Published: 2016-01-25
Description: Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects.
CVSS Score: 7.6 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1614
Published: 2016-01-25
Description: The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0.2564.82, mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1615
Published: 2016-01-25
Description: The Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof a document's origin via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1616
Published: 2016-01-25
Description: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoof URLs via vectors involving an unfocused custom button.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1617
Published: 2016-01-25
Description: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1618
Published: 2016-01-25
Description: Blink, as used in Google Chrome before 48.0.2564.82, does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1619
Published: 2016-01-25
Description: Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-1620
Published: 2016-01-25
Description: Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE: CVE-2016-2051
Published: 2016-01-25
Description: Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://rhn.redhat.com/errata/RHSA-2016-0072.html; http://www.securityfocus.com/bid/81431
CVE: CVE-2016-2052
Published: 2016-01-25
Description: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
CVSS Score: 7.6 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00070.html; http://rhn.redhat.com/errata/RHSA-2016-0072.html
CVE: CVE-2015-6337
Published: 2016-01-26
Description: Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows remote attackers to inject arbitrary web script or HTML via a crafted hostname in an SNMP response, aka Bug ID CSCuw47238.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160125-api; http://www.securitytracker.com/id/1034827; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160125-api
CVE: CVE-2016-1298
Published: 2016-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160125-ucce; http://www.securitytracker.com/id/1034828; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160125-ucce
CVE: CVE-2015-7974
Published: 2016-01-26
Description: NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
CVSS Score: 7.7 (HIGH)
CWE: CWE-287
References: http://bugs.ntp.org/show_bug.cgi?id=2936; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2936
CVE: CVE-2015-8379
Published: 2016-01-26
Description: CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html; http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html; http://karmainsecurity.com/KIS-2016-01
CVE: CVE-2016-0869
Published: 2016-01-26
Description: Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.promotic.eu/en/pmdoc/NewsPm803.htm#ver80311; https://ics-cert.us-cert.gov/advisories/ICSA-16-026-01; http://www.promotic.eu/en/pmdoc/NewsPm803.htm#ver80311
CVE: CVE-2016-1233
Published: 2016-01-26
Description: An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an ioctl.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2016/dsa-3451; http://www.debian.org/security/2016/dsa-3451
CVE: CVE-2016-1489
Published: 2016-01-26
Description: Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files in cleartext, which allows remote attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200, CWE-254
References: http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html; http://seclists.org/fulldisclosure/2016/Jan/67; http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities
CVE: CVE-2016-1490
Published: 2016-01-26
Description: The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html; http://seclists.org/fulldisclosure/2016/Jan/67; http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities
CVE: CVE-2016-1491
Published: 2016-01-26
Description: The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows, when configured to receive files, has a hardcoded password of 12345678, which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
CVSS Score: 8.8 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html; http://seclists.org/fulldisclosure/2016/Jan/67; http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities
CVE: CVE-2016-1492
Published: 2016-01-26
Description: The Wifi hotspot in Lenovo SHAREit before 3.5.48_ww for Android, when configured to receive files, does not require a password, which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html; http://seclists.org/fulldisclosure/2016/Jan/67; http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities
CVE: CVE-2016-1567
Published: 2016-01-26
Description: chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
CVSS Score: 8.1 (HIGH)
CWE: CWE-254
References: http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176559.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
CVE: CVE-2016-1926
Published: 2016-01-26
Description: Cross-site scripting (XSS) vulnerability in the charts module in Greenbone Security Assistant (GSA) 6.x before 6.0.8 allows remote attackers to inject arbitrary web script or HTML via the aggregate_type parameter in a get_aggregate command to omp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183371.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184478.html; http://packetstormsecurity.com/files/135328/OpenVAS-Greenbone-Security-Assistant-Cross-Site-Scripting.html
CVE: CVE-2015-7439
Published: 2016-01-27
Description: Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebSphere Software (RSA4WS) 8.5 through 9.5, and Rational Software Architect RealTime (RSART) 8.5 through 9.5, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972909; http://www-01.ibm.com/support/docview.wss?uid=swg21972909
CVE: CVE-2015-7487
Published: 2016-01-27
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX002, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX002, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow local users to obtain sensitive information by leveraging administrative privileges and reading log files.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21974537; http://www-01.ibm.com/support/docview.wss?uid=swg21974537
CVE: CVE-2015-7488
Published: 2016-01-27
Description: IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005580; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005580
CVE: CVE-2016-0209
Published: 2016-01-27
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF09 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21974564; http://www.securitytracker.com/id/1034844; http://www-01.ibm.com/support/docview.wss?uid=swg21974564
CVE: CVE-2016-1896
Published: 2016-01-27
Description: Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254, CWE-264
References: http://support.lexmark.com/index?page=content&id=TE745; http://support.lexmark.com/index?page=content&id=TE745
CVE: CVE-2015-8618
Published: 2016-01-27
Description: The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175642.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176179.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00077.html
CVE: CVE-2016-1923
Published: 2016-01-27
Description: Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/01/18/4; http://www.openwall.com/lists/oss-security/2016/01/18/7; https://security.gentoo.org/glsa/201612-26
CVE: CVE-2016-1924
Published: 2016-01-27
Description: The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3665; http://www.openwall.com/lists/oss-security/2016/01/18/4; http://www.openwall.com/lists/oss-security/2016/01/18/7
CVE: CVE-2016-1982
Published: 2016-01-27
Description: The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via crafted chunk-encoded content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176475.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176492.html; http://www.debian.org/security/2016/dsa-3460
CVE: CVE-2016-1983
Published: 2016-01-27
Description: The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP Host header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.302&r2=1.303; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176475.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176492.html
CVE: CVE-2016-2047
Published: 2016-01-27
Description: The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.html
CVE: CVE-2015-6319
Published: 2016-01-27
Description: SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-rv220; http://www.securitytracker.com/id/1034830; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-rv220
CVE: CVE-2015-6421
Published: 2016-01-27
Description: cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service (WAAS) and Virtual WAAS (vWAAS) devices 5.x before 5.3.5d and 5.4 and 5.5 before 5.5.3 allows remote attackers to cause a denial of service (resource consumption and device reload) via crafted network traffic, aka Bug ID CSCus85330.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-waascifs; http://www.securitytracker.com/id/1034831; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-waascifs
CVE: CVE-2016-1299
Published: 2016-01-27
Description: The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service (HTTPS outage) via crafted HTTPS requests, aka Bug ID CSCuw87174.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-sbms; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-sbms