deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7858
Published: 2015-10-29
Description: SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sql-injection.html; http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html; http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html
CVE: CVE-2015-7859
Published: 2015-10-29
Description: The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://developer.joomla.org/security-centre/[PII_REDACTED]2-core-acl-violations.html; http://www.securitytracker.com/id/1033950; http://developer.joomla.org/security-centre/[PII_REDACTED]2-core-acl-violations.html
CVE: CVE-2015-7899
Published: 2015-10-29
Description: The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://developer.joomla.org/security-centre/[PII_REDACTED]3-core-acl-violations.html; http://www.securitytracker.com/id/1033950; http://developer.joomla.org/security-centre/[PII_REDACTED]3-core-acl-violations.html
CVE: CVE-2015-6344
Published: 2015-10-30
Description: The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151027-cas; http://www.securitytracker.com/id/1034001; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151027-cas
CVE: CVE-2015-6345
Published: 2015-10-30
Description: SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs; http://www.securitytracker.com/id/1033967; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs
CVE: CVE-2015-6346
Published: 2015-10-30
Description: Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss; http://www.securitytracker.com/id/1033969; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss
CVE: CVE-2015-6347
Published: 2015-10-30
Description: The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac; http://www.securitytracker.com/id/1033971; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac
CVE: CVE-2015-6348
Published: 2015-10-30
Description: The report-generation web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and read report or status information, by visiting an unspecified web page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac1; http://www.securitytracker.com/id/1033970; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac1
CVE: CVE-2015-6349
Published: 2015-10-30
Description: Cross-site scripting (XSS) vulnerability in the web interface in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss1; http://www.securitytracker.com/id/1033968; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss1
CVE: CVE-2015-6350
Published: 2015-10-30
Description: SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151028-psc; http://www.securitytracker.com/id/1034023; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151028-psc
CVE: CVE-2015-6351
Published: 2015-10-30
Description: Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) via a crafted header in a BGP packet, aka Bug ID CSCuw65781.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151028-asr; http://www.securitytracker.com/id/1034024; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151028-asr
CVE: CVE-2015-6352
Published: 2015-10-30
Description: Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151027-ucd; http://www.securityfocus.com/bid/77341; http://www.securitytracker.com/id/1034022
CVE: CVE-2015-7813
Published: 2015-10-30
Description: Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7814
Published: 2015-10-30
Description: Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119, CWE-362
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7835
Published: 2015-10-30
Description: The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7969
Published: 2015-10-30
Description: Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7970
Published: 2015-10-30
Description: The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7971
Published: 2015-10-30
Description: Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
CVSS Score: 2.1 (LOW)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-7972
Published: 2015-10-30
Description: The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
CVE: CVE-2015-8028
Published: 2015-10-30
Description: Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-526; http://www.zerodayinitiative.com/advisories/ZDI-15-531; http://www.zerodayinitiative.com/advisories/ZDI-15-526
CVE: CVE-2015-8029
Published: 2015-10-30
Description: SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-532; http://www.zerodayinitiative.com/advisories/ZDI-15-532
CVE: CVE-2015-8030
Published: 2015-10-30
Description: SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO, (3) JPEG2000, or (4) FBX file, aka "Out-Of-Bounds Indexing" vulnerabilities.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-527; http://www.zerodayinitiative.com/advisories/ZDI-15-528; http://www.zerodayinitiative.com/advisories/ZDI-15-529
CVE: CVE-2015-5667
Published: 2015-10-31
Description: Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN53973084/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172934.html
CVE: CVE-2015-6032
Published: 2015-10-31
Description: Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digital signatures for code by leveraging knowledge of a key from a different installation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/573848; http://www.kb.cert.org/vuls/id/573848
CVE: CVE-2015-6033
Published: 2015-10-31
Description: Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/573848; http://www.kb.cert.org/vuls/id/573848
CVE: CVE-2015-6343
Published: 2015-10-31
Description: The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service via crafted SIP messages, aka Bug ID CSCuv79202.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151026-cube; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151026-cube
CVE: CVE-2015-6353
Published: 2015-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc1; http://www.securitytracker.com/id/1034040; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc1
CVE: CVE-2015-6354
Published: 2015-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc2; http://www.securitytracker.com/id/1034041; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151029-fsmc2
CVE: CVE-2015-1775
Published: 2015-11-02
Description: Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/10/13/2; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities; http://www.openwall.com/lists/oss-security/2015/10/13/2
CVE: CVE-2015-3186
Published: 2015-11-02
Description: Cross-site scripting (XSS) vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/10/13/1; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities; http://www.openwall.com/lists/oss-security/2015/10/13/1
CVE: CVE-2015-3270
Published: 2015-11-02
Description: Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/10/13/3; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities; http://www.openwall.com/lists/oss-security/2015/10/13/3
CVE: CVE-2015-5210
Published: 2015-11-02
Description: Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/10/13/4; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities; http://www.openwall.com/lists/oss-security/2015/10/13/4
CVE: CVE-2015-5291
Published: 2015-11-02
Description: Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170317.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169765.html
CVE: CVE-2015-5308
Published: 2015-11-02
Description: Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vapid.dhs.org/advisory.php?v=155; https://wpvulndb.com/vulnerabilities/8221; http://www.vapid.dhs.org/advisory.php?v=155
CVE: CVE-2015-5470
Published: 2015-11-02
Description: The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2015/07/07/6; http://www.openwall.com/lists/oss-security/2015/07/10/8; https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/
CVE: CVE-2015-5534
Published: 2015-11-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the authentication of administrators for requests that (1) put the website under maintenance via the maintenance_enable parameter or (2) conduct cross-site scripting (XSS) attacks via the maintenance_text parameter to admin/pages/maintenance.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/134124/Oxwall-1.7.4-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/536784/100/0/threaded; https://www.exploit-db.com/exploits/38581/
CVE: CVE-2015-6031
Published: 2015-11-02
Description: Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00122.html; http://talosintel.com/reports/TALOS-2015-0035/; http://www.debian.org/security/2015/dsa-3379
CVE: CVE-2015-8036
Published: 2015-11-02
Description: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session.  NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00009.html; http://www.debian.org/security/2016/dsa-3468
CVE: CVE-2015-8037
Published: 2015-11-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SOMVpnSSLPortalDialog or (2) FGDMngUpdHistory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui; http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui
CVE: CVE-2015-8038
Published: 2015-11-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui; http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui
CVE: CVE-2015-8039
Published: 2015-11-02
Description: Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors to the (1) DVRSetupSave method in the STWAxConfig control or (2) SendCustomPacket method in the STWAxConfigNVR control, which trigger an untrusted pointer dereference.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/77079; http://www.zerodayinitiative.com/advisories/ZDI-15-462; http://www.zerodayinitiative.com/advisories/ZDI-15-463
CVE: CVE-2015-8040
Published: 2015-11-02
Description: The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/77084; http://www.zerodayinitiative.com/advisories/ZDI-15-464; http://www.securityfocus.com/bid/77084
CVE: CVE-2015-6608
Published: 2015-11-03
Description: mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574, 23680780, 23876444, and 23658148, a different vulnerability than CVE-2015-8072 and CVE-2015-8073.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049