deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5321
Published: 2015-11-25
Description: The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-5322
Published: 2015-11-25
Description: Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-5323
Published: 2015-11-25
Description: Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-5324
Published: 2015-11-25
Description: Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-5325
Published: 2015-11-25
Description: Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-5326
Published: 2015-11-25
Description: Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
CVE: CVE-2015-8103
Published: 2015-11-25
Description: The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins; http://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html; http://rhn.redhat.com/errata/RHSA-2016-0489.html
CVE: CVE-2015-6382
Published: 2015-11-26
Description: Cisco ASR 5000 devices with software 16.0(900) allow remote attackers to cause a denial of service (telnetd process restart) via a TELNET connection, aka Bug ID CSCuv25815.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-asr5000; http://www.securitytracker.com/id/1034254; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-asr5000
CVE: CVE-2015-6857
Published: 2015-11-26
Description: Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-3138.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/bid/77946; http://www.securitytracker.com/id/1034259; http://www.zerodayinitiative.com/advisories/ZDI-15-581
CVE: CVE-2015-8363
Published: 2015-11-26
Description: The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=44a7f17d0b20e6f8d836b2957e3e357b639f19a2; http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html; https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html
CVE: CVE-2015-8364
Published: 2015-11-26
Description: Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=df91aa034b82b77a3c4e01791f4a2b2ff6c82066; http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html; http://www.ubuntu.com/usn/USN-2944-1
CVE: CVE-2015-8365
Published: 2015-11-26
Description: The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=4a9af07a49295e014b059c1ab624c40345af5892; http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html; http://www.debian.org/security/2017/dsa-4012
CVE: CVE-2015-6848
Published: 2015-11-27
Description: EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-284
References: http://seclists.org/bugtraq/2015/Nov/121; http://seclists.org/bugtraq/2015/Nov/121
CVE: CVE-2015-8214
Published: 2015-11-27
Description: A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs.
CVSS Score: 9.7 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/78345; http://www.securitytracker.com/id/1034279; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-763427.pdf
CVE: CVE-2015-6385
Published: 2015-12-01
Description: The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables, aka Bug ID CSCux14943.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr; http://www.securitytracker.com/id/1034274; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
CVE: CVE-2015-6386
Published: 2015-12-01
Description: The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumption) via FTP sessions in which the control connection is ended after data transfer, aka Bug ID CSCut94150.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-wsa; http://www.securitytracker.com/id/1034276; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-wsa
CVE: CVE-2015-2327
Published: 2015-12-02
Description: PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.fortiguard.com/advisory/FG-VD-15-010/
CVE: CVE-2015-2328
Published: 2015-12-02
Description: PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
CVE: CVE-2015-8380
Published: 2015-12-02
Description: The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173700.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8381
Published: 2015-12-02
Description: The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8382
Published: 2015-12-02
Description: The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c351b47ce85a3a147cfa801fa9f0149ab4160834; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510
CVE: CVE-2015-8383
Published: 2015-12-02
Description: PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
CVE: CVE-2015-8384
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8385
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
CVE: CVE-2015-8386
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html
CVE: CVE-2015-8387
Published: 2015-12-02
Description: PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8388
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-185
References: http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
CVE: CVE-2015-8389
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-185
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8390
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8391
Published: 2015-12-02
Description: The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html
CVE: CVE-2015-8392
Published: 2015-12-02
Description: PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8393
Published: 2015-12-02
Description: pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8394
Published: 2015-12-02
Description: PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8395
Published: 2015-12-02
Description: PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup; http://www.openwall.com/lists/oss-security/2015/11/29/1
CVE: CVE-2015-8024
Published: 2015-12-02
Description: McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username "NGCP|NGCP|NGCP;" and any password.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://www.quantumleap.it/mcafee-siem-esm-esmrec-and-esmlm-authentication-bypass-vulnerability/; http://www.securitytracker.com/id/1034288; https://kc.mcafee.com/corporate/index?page=content&id=SB10137
CVE: CVE-2015-6383
Published: 2015-12-03
Description: Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa; http://www.securityfocus.com/bid/78521; http://www.securitytracker.com/id/1034277
CVE: CVE-2015-6390
Published: 2015-12-03
Description: Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCup92741.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-pca; http://www.securitytracker.com/id/1034286; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-pca
CVE: CVE-2015-0859
Published: 2015-12-03
Description: The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://www.debian.org/security/2015/dsa-3405; http://www.debian.org/security/2015/dsa-3405
CVE: CVE-2015-0860
Published: 2015-12-03
Description: Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://www.debian.org/security/2015/dsa-3407; http://www.ubuntu.com/usn/USN-2820-1; https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/extract.c?id=e65aa3db04eb908c9507d5d356a95cedb890814d
CVE: CVE-2015-5245
Published: 2015-12-03
Description: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html; http://tracker.ceph.com/issues/12537; https://access.redhat.com/errata/RHSA-2015:2512