deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0512
Published: 2015-02-02
Description: Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2015-01/0147.html; http://www.securityfocus.com/bid/72374; http://www.securitytracker.com/id/1031684
CVE: CVE-2015-0595
Published: 2015-02-02
Description: The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/62686; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0595; http://tools.cisco.com/security/center/viewAlert.x?alertId=37238
CVE: CVE-2015-0596
Published: 2015-02-02
Description: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/61797; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0596; http://tools.cisco.com/security/center/viewAlert.x?alertId=37239
CVE: CVE-2015-0597
Published: 2015-02-02
Description: The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597; http://tools.cisco.com/security/center/viewAlert.x?alertId=37240; http://www.securityfocus.com/bid/72373
CVE: CVE-2015-0866
Published: 2015-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/534564/100/0/threaded; http://www.securityfocus.com/bid/72349; https://forums.manageengine.com/topic/security-update-for-supportcenter-plus
CVE: CVE-2015-1049
Published: 2015-02-02
Description: The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-954136.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-954136.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-954136.pdf
CVE: CVE-2015-1357
Published: 2015-02-02
Description: Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf
CVE: CVE-2015-1383
Published: 2015-02-02
Description: Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jan/113; http://www.openwall.com/lists/oss-security/2015/01/27/26; https://wordpress.org/plugins/geo-mashup/changelog/
CVE: CVE-2015-1385
Published: 2015-02-02
Description: Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130155/Blubrry-PowerPress-6.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/130; http://www.securityfocus.com/archive/1/534577/100/0/threaded
CVE: CVE-2015-1393
Published: 2015-02-02
Description: SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/534569/100/0/threaded; https://plugins.trac.wordpress.org/changeset/1074134/photo-gallery; http://www.securityfocus.com/archive/1/534569/100/0/threaded
CVE: CVE-2015-1448
Published: 2015-02-02
Description: The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf
CVE: CVE-2015-1449
Published: 2015-02-02
Description: Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf
CVE: CVE-2015-1450
Published: 2015-02-02
Description: SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130122/Restaurantbiller-SQL-Injection-Shell-Upload.html; http://packetstormsecurity.com/files/130122/Restaurantbiller-SQL-Injection-Shell-Upload.html
CVE: CVE-2014-0998
Published: 2015-02-02
Description: Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, which triggers an array index error and out-of-bounds kernel memory access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://seclists.org/fulldisclosure/2015/Jan/107; http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities; http://www.securityfocus.com/archive/1/534563/100/0/threaded
CVE: CVE-2014-8612
Published: 2015-02-02
Description: Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2015/Jan/107; http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities; http://www.securityfocus.com/archive/1/534563/100/0/threaded
CVE: CVE-2014-8613
Published: 2015-02-02
Description: The sctp module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted RE_CONFIG chunk.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/72345; http://www.securitytracker.com/id/1031649; https://www.freebsd.org/security/advisories/FreeBSD-SA-15:03.sctp.asc
CVE: CVE-2015-0223
Published: 2015-02-02
Description: Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130106/Apache-Qpid-0.30-Anonymous-Action-Prevention.html; http://seclists.org/bugtraq/2015/Jan/122; http://www.securityfocus.com/bid/72319
CVE: CVE-2015-1451
Published: 2015-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jan/125; http://secunia.com/advisories/61661; http://www.fortiguard.com/advisory/FG-IR-15-002/
CVE: CVE-2015-1452
Published: 2015-02-02
Description: The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-17
References: http://seclists.org/fulldisclosure/2015/Jan/125; http://secunia.com/advisories/61661; http://www.fortiguard.com/advisory/FG-IR-15-002/
CVE: CVE-2015-1453
Published: 2015-02-02
Description: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2015/Jan/124; http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf; http://www.securityfocus.com/bid/72383
CVE: CVE-2015-1454
Published: 2015-02-02
Description: Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.
CVSS Score: 7.1 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/62617; https://bto.bluecoat.com/security-advisory/sa89; http://secunia.com/advisories/62617
CVE: CVE-2015-0313
Published: 2015-02-02
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
CVE: CVE-2014-5360
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Feb/6; http://seclists.org/fulldisclosure/2015/Feb/6
CVE: CVE-2014-8779
Published: 2015-02-03
Description: Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and Conferencing Nodes by leveraging these keys.
CVSS Score: 7.1 (HIGH)
CWE: CWE-254
References: http://packetstormsecurity.com/files/130174/Pexip-Infinity-Non-Unique-SSH-Host-Keys.html; http://www.pexip.com/sites/pexip/files/Pexip_Security_Bulletin_2015-01-02.pdf; http://www.securityfocus.com/archive/1/534576/100/0/threaded
CVE: CVE-2014-9328
Published: 2015-02-03
Description: ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148950.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148958.html
CVE: CVE-2014-9556
Published: 2015-02-03
Description: Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0052.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00004.html; http://secunia.com/advisories/62793
CVE: CVE-2014-9559
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in SnipSnap 0.5.2a, 1.0b1, and 1.0b2 allows remote attackers to inject arbitrary web script or HTML via the query parameter to /snipsnap-search.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Feb/1; http://tetraph.com/security/cves/cve-2014-9559-snipsnap-xss-cross-site-scripting-security-vulnerabilities/; http://seclists.org/fulldisclosure/2015/Feb/1
CVE: CVE-2014-9568
Published: 2015-02-03
Description: puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://puppetlabs.com/security/cve/cve-2014-9568; http://puppetlabs.com/security/cve/cve-2014-9568
CVE: CVE-2014-9574
Published: 2015-02-03
Description: Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/100506; https://fluxbb.org/forums/viewtopic.php?id=8203; https://www.htbridge.com/advisory/HTB23246
CVE: CVE-2014-9633
Published: 2015-02-03
Description: The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, which triggers a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://forums.comodo.com/news-announcements-feedback-cb/comodo-backup-44123-released-t107293.0.html; http://packetstormsecurity.com/files/130094/Comodo-Backup-4.4.0.0-NULL-Pointer-Dereference.html; http://www.exploit-db.com/exploits/35905
CVE: CVE-2015-1348
Published: 2015-02-03
Description: Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.arubanetworks.com/support/alerts/aruba-psa-2015-001.txt; http://www.arubanetworks.com/support/alerts/aruba-psa-2015-001.txt
CVE: CVE-2015-1380
Published: 2015-02-03
Description: jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup; http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/currentjcc.c/?r1=1.433&r2=1.434; http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html
CVE: CVE-2015-1381
Published: 2015-02-03
Description: Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup; http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47; http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html
CVE: CVE-2015-1382
Published: 2015-02-03
Description: parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup; http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298; http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.html
CVE: CVE-2015-1384
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Feb/2; http://www.securityfocus.com/archive/1/534592/100/0/threaded; https://wordpress.org/plugins/banner-effect-header/changelog/
CVE: CVE-2015-1400
Published: 2015-02-03
Description: SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.html; http://websecgeeks.com/npds-cms-sql-injection/; http://www.npds.org/viewtopic.php?topic=26189&forum=12
CVE: CVE-2015-1402
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/; http://www.openwall.com/lists/oss-security/2015/01/11/7; http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE: CVE-2015-1403
Published: 2015-02-03
Description: SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/; http://www.openwall.com/lists/oss-security/2015/01/11/7; http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE: CVE-2015-1404
Published: 2015-02-03
Description: Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/; http://www.openwall.com/lists/oss-security/2015/01/11/7; http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE: CVE-2015-1405
Published: 2015-02-03
Description: SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/; http://www.openwall.com/lists/oss-security/2015/01/11/7; http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE: CVE-2015-1428
Published: 2015-02-03
Description: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/35972; http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html; http://www.securityfocus.com/archive/1/534593/100/0/threaded
CVE: CVE-2015-1433
Published: 2015-02-03
Description: program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html; http://roundcube.net/news/2015/01/24/security-update-1.0.5/
CVE: CVE-2015-1441
Published: 2015-02-03
Description: SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://piwigo.org/forum/viewtopic.php?id=25016; http://piwigo.org/releases/2.5.6; http://piwigo.org/releases/2.6.5
CVE: CVE-2015-1455
Published: 2015-02-03
Description: Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html; http://www.fortiguard.com/advisory/FG-IR-15-003/; http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
CVE: CVE-2015-1456
Published: 2015-02-03
Description: Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html; http://www.fortiguard.com/advisory/FG-IR-15-003/; http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
CVE: CVE-2015-1457
Published: 2015-02-03
Description: Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html; http://www.fortiguard.com/advisory/FG-IR-15-003/; http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf