deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0769
Published: 2015-06-12
Description: Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extension headers, aka Bug ID CSCtx03546.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150611-iosxr; http://www.securitytracker.com/id/1032563; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150611-iosxr
CVE: CVE-2015-0772
Published: 2015-06-12
Description: Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection, aka Bug ID CSCut42422.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39240; http://www.securitytracker.com/id/1032540; http://tools.cisco.com/security/center/viewAlert.x?alertId=39240
CVE: CVE-2015-0775
Published: 2015-06-12
Description: The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices, 5.2(1)SV3(2.1) on Nexus 1000V devices, 6.0(2)N2(2) on Nexus 5000 devices, 6.2(11) on MDS 9000 devices, 6.2(12) on Nexus 7000 devices, 7.0(3) on Nexus 9000 devices, and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup, aka Bug IDs CSCuo10554, CSCuu75466, CSCuu75471, CSCuu75484, CSCuu75498, CSCuu77170, and CSCuu77182.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39280; http://www.securitytracker.com/id/1032561; http://www.securitytracker.com/id/1032562
CVE: CVE-2015-0776
Published: 2015-06-12
Description: telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka Bug ID CSCuq31566.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39293; http://www.securitytracker.com/id/1032560; http://tools.cisco.com/security/center/viewAlert.x?alertId=39293
CVE: CVE-2015-4182
Published: 2015-06-12
Description: The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39299; http://www.securityfocus.com/bid/75152; http://www.securitytracker.com/id/1032579
CVE: CVE-2014-8176
Published: 2015-06-12
Description: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html
CVE: CVE-2015-1788
Published: 2015-06-12
Description: The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery; http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc
CVE: CVE-2015-1789
Published: 2015-06-12
Description: The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
CVE: CVE-2015-1790
Published: 2015-06-12
Description: The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
CVSS Score: 5.0 (MEDIUM)
References: http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
CVE: CVE-2015-1791
Published: 2015-06-12
Description: Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
CVE: CVE-2015-1792
Published: 2015-06-12
Description: The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
CVE: CVE-2015-4184
Published: 2015-06-13
Description: The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39339; http://www.securityfocus.com/bid/75181; http://www.securitytracker.com/id/1032582
CVE: CVE-2015-4185
Published: 2015-06-13
Description: The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39343; http://www.securityfocus.com/bid/72310; http://www.securitytracker.com/id/1032581
CVE: CVE-2015-2336
Published: 2015-06-13
Description: TPView.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute arbitrary code on the host OS via unspecified vectors, a different vulnerability than CVE-2012-0897.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75095; http://www.securitytracker.com/id/1032529; http://www.securitytracker.com/id/1032530
CVE: CVE-2015-2337
Published: 2015-06-13
Description: TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75095; http://www.securitytracker.com/id/1032529; http://www.securitytracker.com/id/1032530
CVE: CVE-2015-2338
Published: 2015-06-13
Description: TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2339.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75092; http://www.securitytracker.com/id/1032529; http://www.securitytracker.com/id/1032530
CVE: CVE-2015-2339
Published: 2015-06-13
Description: TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75092; http://www.securitytracker.com/id/1032529; http://www.securitytracker.com/id/1032530
CVE: CVE-2015-2340
Published: 2015-06-13
Description: TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/75092; http://www.securitytracker.com/id/1032529; http://www.securitytracker.com/id/1032530
CVE: CVE-2015-2341
Published: 2015-06-13
Description: VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.6, and VMware Fusion 6.x before 6.0.6 and 7.x before 7.0.1 allow attackers to cause a denial of service against a 32-bit guest OS or 64-bit host OS via a crafted RPC command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/75094; http://www.securitytracker.com/id/1032530; http://www.vmware.com/security/advisories/VMSA-2015-0004.html
CVE: CVE-2015-2954
Published: 2015-06-13
Description: Cross-site request forgery (CSRF) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN12241436/995646/index.html; http://jvn.jp/en/jp/JVN12241436/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000079
CVE: CVE-2015-2955
Published: 2015-06-13
Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN05559185/995646/index.html; http://jvn.jp/en/jp/JVN05559185/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000080
CVE: CVE-2015-2956
Published: 2015-06-13
Description: SQL injection vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN52478686/995646/index.html; http://jvn.jp/en/jp/JVN52478686/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000081
CVE: CVE-2015-2957
Published: 2015-06-13
Description: Cross-site scripting (XSS) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN20879350/995646/index.html; http://jvn.jp/en/jp/JVN20879350/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000082
CVE: CVE-2015-2962
Published: 2015-06-13
Description: CGI RESCUE BloBee 1.20 and earlier allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN24336273/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000087; http://www.securityfocus.com/bid/75183
CVE: CVE-2015-3993
Published: 2015-06-13
Description: Actian Matrix 5.1.x through 5.1.2.4 and 5.2.x through 5.2.0.1 allows remote authenticated users to bypass intended write-access restrictions and execute an UPDATE statement by referencing a table.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://supportservices.actian.com/images/pdf/Actian-SecAlert_May_2015_NO2_final.doc; http://www.securityfocus.com/bid/75187; http://supportservices.actian.com/images/pdf/Actian-SecAlert_May_2015_NO2_final.doc
CVE: CVE-2015-0343
Published: 2015-06-13
Description: Cross-site scripting (XSS) vulnerability in admin/home/homepage/search in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132269/Adobe-Connect-9.3-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2015/Jun/61; http://seclists.org/fulldisclosure/2015/Jun/35
CVE: CVE-2015-0344
Published: 2015-06-13
Description: Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1032567; https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html#Issues%20Resolved; http://www.securitytracker.com/id/1032567
CVE: CVE-2015-2952
Published: 2015-06-13
Description: The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than CVE-2015-2953 and CVE-2015-2958.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN19732015/995646/index.html; http://jvn.jp/en/jp/JVN19732015/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000077
CVE: CVE-2015-2953
Published: 2015-06-13
Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN16409640/995646/index.html; http://jvn.jp/en/jp/JVN16409640/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000078
CVE: CVE-2015-2958
Published: 2015-06-13
Description: Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN74280258/995646/index.html; http://jvn.jp/en/jp/JVN74280258/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000083
CVE: CVE-2012-4716
Published: 2015-06-13
Description: N-Tron 702-W Industrial Wireless Access Point devices use the same (1) SSH and (2) HTTPS private keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
CVSS Score: 8.8 (HIGH)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-160-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-160-01
CVE: CVE-2015-3949
Published: 2015-06-13
Description: Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/75100; https://ics-cert.us-cert.gov/advisories/ICSA-15-160-02; http://www.securityfocus.com/bid/75100
CVE: CVE-2015-3951
Published: 2015-06-13
Description: RLE Nova-Wind Turbine HMI devices store cleartext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/75163; https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01; http://www.securityfocus.com/bid/75163
CVE: CVE-2015-4344
Published: 2015-06-15
Description: The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource restrictions via vectors related to page caching.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72677; https://www.drupal.org/node/2428851
CVE: CVE-2015-4345
Published: 2015-06-15
Description: The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72676; https://www.drupal.org/node/2428855
CVE: CVE-2015-4346
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72807; https://www.drupal.org/node/2431717
CVE: CVE-2015-4347
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified path arguments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72802; https://www.drupal.org/node/2437969
CVE: CVE-2015-4348
Published: 2015-06-15
Description: SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72805; https://www.drupal.org/node/2437973
CVE: CVE-2015-4349
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete contact categories via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72805; https://www.drupal.org/node/2437973
CVE: CVE-2015-4350
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72798; https://www.drupal.org/node/2437977
CVE: CVE-2015-4351
Published: 2015-06-15
Description: The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72817; https://www.drupal.org/node/2437981
CVE: CVE-2015-4352
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72817; https://www.drupal.org/node/2437981
CVE: CVE-2015-4353
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72811; https://www.drupal.org/node/2437985
CVE: CVE-2015-4354
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72812; https://www.drupal.org/node/2437991
CVE: CVE-2015-4355
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72810; https://www.drupal.org/node/2437993
CVE: CVE-2015-4356
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72993