deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4357
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a webform block.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72993
CVE: CVE-2015-4358
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72947; https://www.drupal.org/node/2438357
CVE: CVE-2015-4359
Published: 2015-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72961; https://www.drupal.org/node/2445955
CVE: CVE-2015-4360
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72961; https://www.drupal.org/node/2445955
CVE: CVE-2015-4361
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete registration codes via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72961; https://www.drupal.org/node/2445955
CVE: CVE-2015-4362
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in tracking_code.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that disable tracking codes via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://cgit.drupalcode.org/tracking_code/commit/?id=77c8c3d; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72958
CVE: CVE-2015-4363
Published: 2015-06-15
Description: Open redirect vulnerability in the finder_form_goto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72959; https://www.drupal.org/node/2445967
CVE: CVE-2015-4364
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that (1) enable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/enable or (2) disable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/disable. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72953; https://www.drupal.org/node/2445971
CVE: CVE-2015-4365
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72952; https://www.drupal.org/node/2445973
CVE: CVE-2015-4366
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72957; https://www.drupal.org/node/2445977
CVE: CVE-2015-4367
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Simple Subscription module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer blocks" permission to inject arbitrary web script or HTML via vectors related to block content.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72951; https://www.drupal.org/node/2437931
CVE: CVE-2015-4368
Published: 2015-06-15
Description: The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72948; https://www.drupal.org/node/2445835
CVE: CVE-2015-4369
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Trick Question" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/72946; https://www.drupal.org/node/2373143
CVE: CVE-2015-4370
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73051; https://www.drupal.org/node/2450321
CVE: CVE-2015-4371
Published: 2015-06-15
Description: Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73050; https://www.drupal.org/node/2449877
CVE: CVE-2015-4372
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73052; https://www.drupal.org/node/2450015
CVE: CVE-2015-4373
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes posted in an Organic Groups group.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73054; https://www.drupal.org/node/2404115
CVE: CVE-2015-4375
Published: 2015-06-15
Description: The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; https://www.drupal.org/node/2454883
CVE: CVE-2015-4376
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Profile2 Privacy Levels" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/03/22/35; http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/73223
CVE: CVE-2015-4377
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; https://www.drupal.org/node/2458683; https://www.drupal.org/node/2459311
CVE: CVE-2015-4378
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; https://www.drupal.org/node/2458675; https://www.drupal.org/node/2459315
CVE: CVE-2015-4379
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74343; https://www.drupal.org/node/2459031
CVE: CVE-2015-4380
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74340; https://www.drupal.org/node/2459197
CVE: CVE-2015-4381
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice" content type.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74345; https://www.drupal.org/node/2459337
CVE: CVE-2015-4382
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) create, (2) delete, or (3) alter invoices via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74345; https://www.drupal.org/node/2459337
CVE: CVE-2015-4383
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74344; https://www.drupal.org/node/2459349
CVE: CVE-2015-4384
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74341; https://www.drupal.org/node/2459359
CVE: CVE-2015-4385
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74349; https://www.drupal.org/node/2463237
CVE: CVE-2015-4386
Published: 2015-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74347; https://www.drupal.org/node/2463049
CVE: CVE-2015-4387
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal, when a site has a policy that uses the username constraint, allows remote attackers to inject arbitrary web script or HTML via a crafted username that is imported from an external source.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74348; https://www.drupal.org/node/2463327
CVE: CVE-2015-4388
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the keywords passed by the user to the list" option is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted search query.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74357; https://www.drupal.org/node/2463493
CVE: CVE-2015-4389
Published: 2015-06-15
Description: The Open Graph Importer (og_tag_importer) 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import og_tag_importer" permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74354; https://www.drupal.org/node/2463891
CVE: CVE-2015-4390
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) continue or (2) delete an ongoing import via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74352; https://www.drupal.org/node/2463941
CVE: CVE-2015-4391
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74351; https://www.drupal.org/node/2467631
CVE: CVE-2015-4392
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74362; https://www.drupal.org/node/2471721
CVE: CVE-2015-4393
Published: 2015-06-15
Description: The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74365; https://www.drupal.org/node/2471847
CVE: CVE-2015-4394
Published: 2015-06-15
Description: The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74365; https://www.drupal.org/node/2471847
CVE: CVE-2015-4395
Published: 2015-06-15
Description: The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74364; https://www.drupal.org/node/2475443
CVE: CVE-2015-4396
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that (1) create, (2) delete, or (3) set priorities to keywords via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; http://www.securityfocus.com/bid/74361; https://www.drupal.org/node/2475591
CVE: CVE-2015-4397
Published: 2015-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/04/25/6; https://www.drupal.org/node/2475955; http://www.openwall.com/lists/oss-security/2015/04/25/6
CVE: CVE-2015-3209
Published: 2015-06-15
Description: Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html
CVE: CVE-2015-4093
Published: 2015-06-15
Description: Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132232/Kibana-4.0.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535726/100/0/threaded; http://www.securityfocus.com/bid/75107
CVE: CVE-2015-4118
Published: 2015-06-15
Description: SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.  NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugtracker.ispconfig.org/index.php?do=details&task_id=3898; http://packetstormsecurity.com/files/132238/ISPConfig-3.0.5.4p6-SQL-Injection-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/535734/100/0/threaded
CVE: CVE-2015-4119
Published: 2015-06-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugtracker.ispconfig.org/index.php?do=details&task_id=3898; http://packetstormsecurity.com/files/132238/ISPConfig-3.0.5.4p6-SQL-Injection-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/535734/100/0/threaded
CVE: CVE-2015-4141
Published: 2015-06-15
Description: The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html; http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt; http://www.debian.org/security/2015/dsa-3397
CVE: CVE-2015-4142
Published: 2015-06-15
Description: Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171401.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172608.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172655.html
CVE: CVE-2015-4143
Published: 2015-06-15
Description: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html; http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt; http://www.debian.org/security/2015/dsa-3397