deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8562
Published: 2015-12-16
Description: Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/134949/Joomla-HTTP-Header-Unauthenticated-Remote-Code-Execution.html; http://packetstormsecurity.com/files/135100/Joomla-3.4.5-Object-Injection.html; http://www.rapid7.com/db/modules/exploit/multi/http/joomla_http_header_rce
CVE: CVE-2015-8563
Published: 2015-12-16
Description: Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/79199; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-csrf-hardening.html; http://www.securityfocus.com/bid/79199
CVE: CVE-2015-8564
Published: 2015-12-16
Description: Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-22
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-directory-traversal.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-directory-traversal.html
CVE: CVE-2015-8565
Published: 2015-12-16
Description: Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-22
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-directory-traversal-2.html; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-directory-traversal-2.html
CVE: CVE-2015-8566
Published: 2015-12-16
Description: The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/79197; https://developer.joomla.org/security-centre/[PII_REDACTED]5-session-remote-code-execution-vulnerability.html; http://www.securityfocus.com/bid/79197
CVE: CVE-2015-8580
Published: 2015-12-16
Description: Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
References: http://www.zerodayinitiative.com/advisories/ZDI-15-622; http://www.zerodayinitiative.com/advisories/ZDI-15-623; https://www.foxitsoftware.com/support/security-bulletins.php#FRD-34
CVE: CVE-2015-8581
Published: 2015-12-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0779. Reason: This candidate is a duplicate of CVE-2016-0779. Notes: All CVE users should reference CVE-2016-0779 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-4027
Published: 2015-12-17
Description: The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/134602/Acunetix-WVS-10-Local-Privilege-Escalation.html; https://www.acunetix.com/blog/releases/acunetix-10-build-includes-security-checks-in-cors-configurations/; https://www.exploit-db.com/exploits/38847/
CVE: CVE-2015-5204
Published: 2015-12-17
Description: CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/76832; https://cordova.apache.org/news/2015/09/21/file-transfer-release.html; http://www.securityfocus.com/bid/76832
CVE: CVE-2015-5277
Published: 2015-12-17
Description: The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://rhn.redhat.com/errata/RHSA-2015-2172.html; http://seclists.org/fulldisclosure/2019/Sep/7
CVE: CVE-2015-7518
Published: 2015-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/12611; http://theforeman.org/security.html#2015-7518; http://www.openwall.com/lists/oss-security/2015/12/09/6
CVE: CVE-2015-7527
Published: 2015-12-17
Description: lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html; http://www.openwall.com/lists/oss-security/2015/12/02/9; http://www.securityfocus.com/archive/1/537051/100/0/threaded
CVE: CVE-2015-8327
Published: 2015-12-17
Description: Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
CVSS Score: 7.5 (HIGH)
References: http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/annotate/head:/NEWS; http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7406; http://lists.opensuse.org/opensuse-updates/2016-01/msg00065.html
CVE: CVE-2015-8338
Published: 2015-12-17
Description: Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-254
References: http://www.debian.org/security/2016/dsa-3633; http://www.securityfocus.com/bid/78920; http://www.securitytracker.com/id/1034390
CVE: CVE-2015-8339
Published: 2015-12-17
Description: The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-19
References: http://support.citrix.com/article/CTX203451; http://www.debian.org/security/2016/dsa-3519; http://www.securityfocus.com/bid/79038
CVE: CVE-2015-8340
Published: 2015-12-17
Description: The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://support.citrix.com/article/CTX203451; http://www.debian.org/security/2016/dsa-3519; http://www.securityfocus.com/bid/79038
CVE: CVE-2015-8341
Published: 2015-12-17
Description: The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3519; http://www.securitytracker.com/id/1034389; http://xenbits.xen.org/xsa/advisory-160.html
CVE: CVE-2015-8368
Published: 2015-12-17
Description: ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-254
References: http://packetstormsecurity.com/files/134593/ntop-ng-2.0.15102-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Dec/10; https://www.exploit-db.com/exploits/38836/
CVE: CVE-2015-8369
Published: 2015-12-17
Description: SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2646; http://packetstormsecurity.com/files/134724/Cacti-0.8.8f-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Dec/8
CVE: CVE-2015-8600
Published: 2015-12-17
Description: The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://scn.sap.com/community/security/blog/2015/12/09/sap-security-notes-december-2015--review; https://erpscan.io/advisories/10761/; http://scn.sap.com/community/security/blog/2015/12/09/sap-security-notes-december-2015--review
CVE: CVE-2015-8601
Published: 2015-12-17
Description: The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/node/2627428; https://www.drupal.org/node/2627478; https://www.drupal.org/node/2627428
CVE: CVE-2015-8602
Published: 2015-12-17
Description: The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://www.drupal.org/node/2571905; https://www.drupal.org/node/2627638; https://www.drupal.org/node/2571905
CVE: CVE-2015-6424
Published: 2015-12-18
Description: The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151216-apic; http://www.securityfocus.com/bid/79410; http://www.securitytracker.com/id/1034468
CVE: CVE-2015-6426
Published: 2015-12-18
Description: Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151217-pnsc; http://www.securityfocus.com/bid/79582; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151217-pnsc
CVE: CVE-2015-6427
Published: 2015-12-18
Description: Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151217-fsm; http://www.securitytracker.com/id/1034488; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151217-fsm
CVE: CVE-2015-6428
Published: 2015-12-18
Description: Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCuv03958.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151217-gateway; http://www.securityfocus.com/bid/79594; http://www.securitytracker.com/id/1034487
CVE: CVE-2015-6556
Published: 2015-12-18
Description: EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption (SEE) before 11.1.0 allows remote authenticated users to discover credentials by triggering a memory dump.
CVSS Score: 2.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/78803; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151214_00; http://www.securityfocus.com/bid/78803
CVE: CVE-2015-6429
Published: 2015-12-19
Description: The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service (IPsec connection termination) via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151218-ios; http://www.securitytracker.com/id/1034505; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151218-ios
CVE: CVE-2015-7755
Published: 2015-12-19
Description: Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713; http://twitter.com/cryptoron/statuses/[PII_REDACTED]60253442
CVE: CVE-2015-7756
Published: 2015-12-19
Description: The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713; http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear/
CVE: CVE-2015-6934
Published: 2015-12-21
Description: Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/79648; http://www.vmware.com/security/advisories/VMSA-2015-0009.html; http://www.securityfocus.com/bid/79648
CVE: CVE-2015-1772
Published: 2015-12-21
Description: The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E; http://www-01.ibm.com/support/docview.wss?uid=swg21969546; http://www.securitytracker.com/id/1034365
CVE: CVE-2015-1836
Published: 2015-12-21
Description: Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5izmYccaKjXaJ3V72KK7tbOhbkg%40mail.gmail.com%3E; http://www-01.ibm.com/support/docview.wss?uid=swg21969546; http://www.securitytracker.com/id/1034365
CVE: CVE-2015-4993
Published: 2015-12-21
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4998.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI47516; http://www-01.ibm.com/support/docview.wss?uid=swg21970176; http://www.securityfocus.com/bid/78609
CVE: CVE-2015-4998
Published: 2015-12-21
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4993.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI47712; http://www-01.ibm.com/support/docview.wss?uid=swg21970176; http://www.securitytracker.com/id/1034284
CVE: CVE-2015-5001
Published: 2015-12-21
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote authenticated users to cause a denial of service (memory consumption) via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI49540; http://www-01.ibm.com/support/docview.wss?uid=swg21970176; http://www.securitytracker.com/id/1034284
CVE: CVE-2015-6480
Published: 2015-12-21
Description: The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287
References: http://zerodayinitiative.com/advisories/ZDI-15-452/; https://ics-cert.us-cert.gov/advisories/ICSA-15-328-01; http://zerodayinitiative.com/advisories/ZDI-15-452/
CVE: CVE-2015-6481
Published: 2015-12-21
Description: The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session.
CVSS Score: 8.3 (HIGH)
References: http://zerodayinitiative.com/advisories/ZDI-15-453/; https://ics-cert.us-cert.gov/advisories/ICSA-15-328-01; http://zerodayinitiative.com/advisories/ZDI-15-453/
CVE: CVE-2015-7413
Published: 2015-12-21
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF19 and 8.5.0 through CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI50844; http://www-01.ibm.com/support/docview.wss?uid=swg21970176; http://www.securitytracker.com/id/1034284
CVE: CVE-2015-7906
Published: 2015-12-21
Description: LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-342-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-342-02
CVE: CVE-2015-7907
Published: 2015-12-21
Description: Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-309-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-309-02
CVE: CVE-2015-7908
Published: 2015-12-21
Description: Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
CVSS Score: 9.3 (HIGH)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-309-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-309-02
CVE: CVE-2015-7919
Published: 2015-12-21
Description: SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-337-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-337-01
CVE: CVE-2015-7937
Published: 2015-12-21
Description: Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01; http://www.securityfocus.com/bid/79622; https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01
CVE: CVE-2015-8458
Published: 2015-12-21
Description: Heap-based buffer overflow in AGM.dll in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2015-6696 and CVE-2015-6698.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/79208; http://www.zerodayinitiative.com/advisories/ZDI-15-637; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
CVE: CVE-2015-4545
Published: 2015-12-21
Description: EMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session.
CVSS Score: 8.0 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2015/Dec/103; http://www.securityfocus.com/bid/79674; http://seclists.org/bugtraq/2015/Dec/103