deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2575
Published: 2015-04-16
Description: Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html; http://lists.opensuse.org/opensuse-updates/2015-05/msg00089.html; http://www.debian.org/security/2016/dsa-3621
CVE: CVE-2015-2576
Published: 2015-04-16
Description: Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.
CVSS Score: 2.1 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html; http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.securitytracker.com/id/1032121
CVE: CVE-2015-2577
Published: 2015-04-16
Description: Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Accounting commands.
CVSS Score: 7.2 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74122; http://www.securitytracker.com/id/1032132
CVE: CVE-2015-2578
Published: 2015-04-16
Description: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows remote attackers to affect availability via vectors related to Kernel IDMap.
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74143; http://www.securitytracker.com/id/1032132
CVE: CVE-2015-2579
Published: 2015-04-16
Description: Unspecified vulnerability in the Oracle Health Sciences Argus Safety component in Oracle Health Sciences Applications 8.0 allows local users to affect confidentiality via vectors related to BIP Installer.
CVSS Score: 2.1 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74113; http://www.securitytracker.com/id/1032130
CVE: CVE-2013-4866
Published: 2015-04-16
Description: The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attackers to trigger physical resource consumption (water or heat) or user discomfort.
CVSS Score: 3.3 (LOW)
References: http://arstechnica.com/security/2013/08/holy-sht-smart-toilet-hack-attack/; http://packetstormsecurity.com/files/122655/LIXIL-Satis-Toilet-Hard-Coded-Bluetooth-PIN.html; http://seclists.org/fulldisclosure/2013/Aug/18
CVE: CVE-2015-1314
Published: 2015-04-16
Description: The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://dnlongen.blogspot.com/2015/01/usaa-mobile-app-gives-away-your-account.html; http://packetstormsecurity.com/files/130067/USAA-Mobile-App-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/Jan/94
CVE: CVE-2015-3320
Published: 2015-04-16
Description: Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing debug output.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/74196; https://support.lenovo.com/us/en/product_security/usbenhancedkeyboard; http://www.securityfocus.com/bid/74196
CVE: CVE-2015-3322
Published: 2015-04-16
Description: Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/74198; https://support.lenovo.com/us/en/product_security/ts_bios_pw; http://www.securityfocus.com/bid/74198
CVE: CVE-2015-3323
Published: 2015-04-16
Description: The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 allows remote attackers to cause a denial of service (web interface crash) via a malformed HTTP request during authentication.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://support.lenovo.com/us/en/product_security/tsm_weak_pw; http://www.securityfocus.com/bid/74197; http://support.lenovo.com/us/en/product_security/tsm_weak_pw
CVE: CVE-2015-3324
Published: 2015-04-16
Description: The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://support.lenovo.com/us/en/product_security/tsm_weak_pw; http://www.securityfocus.com/bid/74199; http://support.lenovo.com/us/en/product_security/tsm_weak_pw
CVE: CVE-2015-0530
Published: 2015-04-17
Description: Buffer overflow in an unspecified function in nsr_render_log in EMC NetWorker before 8.0.4.3, 8.1.x before 8.1.2.6, and 8.2.x before 8.2.1.2 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://seclists.org/bugtraq/2015/Apr/103; http://www.securitytracker.com/id/1032147; http://seclists.org/bugtraq/2015/Apr/103
CVE: CVE-2015-0691
Published: 2015-04-17
Description: A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78, CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd; http://www.securitytracker.com/id/1032140; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd
CVE: CVE-2015-0695
Published: 2015-04-17
Description: Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19, CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-iosxr; http://www.securityfocus.com/bid/74162; http://www.securitytracker.com/id/1032139
CVE: CVE-2015-0700
Published: 2015-04-17
Description: Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38403; http://www.securitytracker.com/id/1032163; http://tools.cisco.com/security/center/viewAlert.x?alertId=38403
CVE: CVE-2015-0937
Published: 2015-04-17
Description: Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/274244; https://bto.bluecoat.com/security-advisory/sa94; http://www.kb.cert.org/vuls/id/274244
CVE: CVE-2015-0938
Published: 2015-04-17
Description: search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/274244; https://bto.bluecoat.com/security-advisory/sa94; http://www.kb.cert.org/vuls/id/274244
CVE: CVE-2015-0845
Published: 2015-04-17
Description: Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.debian.org/security/2015/dsa-3227; http://www.securitytracker.com/id/1032153; https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html
CVE: CVE-2015-1318
Published: 2015-04-17
Description: The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.osvdb.org/120803; http://www.ubuntu.com/usn/USN-2569-1; https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1438758
CVE: CVE-2015-1852
Published: 2015-04-17
Description: The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html; http://rhn.redhat.com/errata/RHSA-2015-1677.html; http://rhn.redhat.com/errata/RHSA-2015-1685.html
CVE: CVE-2015-1856
Published: 2015-04-17
Description: OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163113.html; http://lists.openstack.org/pipermail/openstack-announce/2015-April/000349.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html
CVE: CVE-2015-0967
Published: 2015-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/697316; http://www.kb.cert.org/vuls/id/697316
CVE: CVE-2015-0968
Published: 2015-04-18
Description: Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/697316; http://www.kb.cert.org/vuls/id/697316
CVE: CVE-2015-0969
Published: 2015-04-18
Description: SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/697316; http://www.kb.cert.org/vuls/id/697316
CVE: CVE-2015-0970
Published: 2015-04-18
Description: Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/697316; http://www.kb.cert.org/vuls/id/697316
CVE: CVE-2015-1235
Published: 2015-04-19
Description: The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1236
Published: 2015-04-19
Description: The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1237
Published: 2015-04-19
Description: Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1238
Published: 2015-04-19
Description: Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1240
Published: 2015-04-19
Description: gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1241
Published: 2015-04-19
Description: Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1242
Published: 2015-04-19
Description: The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1244
Published: 2015-04-19
Description: The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1245
Published: 2015-04-19
Description: Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1246
Published: 2015-04-19
Description: Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1247
Published: 2015-04-19
Description: The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1248
Published: 2015-04-19
Description: The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-1249
Published: 2015-04-19
Description: Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
CVE: CVE-2015-3333
Published: 2015-04-19
Description: Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://ubuntu.com/usn/usn-2570-1
CVE: CVE-2015-3334
Published: 2015-04-19
Description: browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://www.debian.org/security/2015/dsa-3238
CVE: CVE-2015-3335
Published: 2015-04-19
Description: The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://www.securityfocus.com/bid/72715
CVE: CVE-2015-3336
Published: 2015-04-19
Description: Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and requestPointerLock calls, and arranging for the user to access this document with a file: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html; http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html; http://www.debian.org/security/2015/dsa-3238
CVE: CVE-2015-0702
Published: 2015-04-21
Description: Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20, CWE-434
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38455; http://www.securitytracker.com/id/1032165; http://tools.cisco.com/security/center/viewAlert.x?alertId=38455
CVE: CVE-2015-0703
Published: 2015-04-21
Description: Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38459; http://www.securitytracker.com/id/1032164; http://tools.cisco.com/security/center/viewAlert.x?alertId=38459
CVE: CVE-2015-1701
Published: 2015-04-21
Description: Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2020/May/34; http://twitter.com/symantec/statuses/[PII_REDACTED]27549440; http://www.securityfocus.com/bid/74245