deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8660
Published: 2015-12-28
Description: The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html
CVE: CVE-2015-6850
Published: 2015-12-28
Description: EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/135041/EMC-VPLEX-Undocumented-Account.html; http://seclists.org/bugtraq/2015/Dec/129; http://www.securityfocus.com/bid/79664
CVE: CVE-2015-6852
Published: 2015-12-28
Description: Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135044/EMC-Secure-Remote-Services-Virtual-Edition-Path-Traversal.html; http://seclists.org/bugtraq/2015/Dec/130; http://www.securityfocus.com/bid/79661
CVE: CVE-2015-8459
Published: 2015-12-28
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8460
Published: 2015-12-28
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8636, and CVE-2015-8645.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8634
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8635
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8636
Published: 2015-12-28
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8645.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8638
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8639
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8640
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8641
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8642
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8643
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8644
Published: 2015-12-28
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8645
Published: 2015-12-28
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8636.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8646
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8647
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8648
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8649, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8649
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, and CVE-2015-8650.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8650
Published: 2015-12-28
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, and CVE-2015-8649.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-8651
Published: 2015-12-28
Description: Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
CVE: CVE-2015-7786
Published: 2015-12-29
Description: Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN70083512/995570/index.html; http://jvn.jp/en/jp/JVN70083512/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000196
CVE: CVE-2015-3223
Published: 2015-12-29
Description: The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-189, CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
CVE: CVE-2015-5252
Published: 2015-12-29
Description: vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
CVE: CVE-2015-5296
Published: 2015-12-29
Description: Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
CVE: CVE-2015-5299
Published: 2015-12-29
Description: The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
CVE: CVE-2015-5330
Published: 2015-12-29
Description: ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html
CVE: CVE-2015-7540
Published: 2015-12-29
Description: The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html
CVE: CVE-2015-7791
Published: 2015-12-29
Description: Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN43344629/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000200; http://www.securityfocus.com/bid/79647
CVE: CVE-2015-8467
Published: 2015-12-29
Description: The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html
CVE: CVE-2015-5663
Published: 2015-12-30
Description: The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that was selected by the user.
CVSS Score: 7.4 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN64636058/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000199; http://www.securityfocus.com/bid/79666
CVE: CVE-2015-7248
Published: 2015-12-30
Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/77421; https://www.exploit-db.com/exploits/38773/; https://www.kb.cert.org/vuls/id/391604
CVE: CVE-2015-7249
Published: 2015-12-30
Description: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/77421; https://www.exploit-db.com/exploits/38773/; https://www.kb.cert.org/vuls/id/391604