deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1266
Published: 2015-06-26
Description: content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html
CVE: CVE-2015-1267
Published: 2015-06-26
Description: Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html
CVE: CVE-2015-1268
Published: 2015-06-26
Description: bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html
CVE: CVE-2015-1269
Published: 2015-06-26
Description: The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html; http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html
CVE: CVE-2015-4199
Published: 2015-06-27
Description: Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39423; http://www.securityfocus.com/bid/75335; http://www.securitytracker.com/id/1032692
CVE: CVE-2015-4225
Published: 2015-06-27
Description: Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39529; http://www.securityfocus.com/bid/75433; http://www.securitytracker.com/id/1032735
CVE: CVE-2014-6198
Published: 2015-06-28
Description: Cross-site request forgery (CSRF) vulnerability in IBM Security Network Protection 5.3 before 5.3.1 allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21958090; http://www.securitytracker.com/id/1032634; http://www-01.ibm.com/support/docview.wss?uid=swg21958090
CVE: CVE-2015-0989
Published: 2015-06-28
Description: PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02; https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02
CVE: CVE-2015-4174
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132514/Climatix-BACnet-IP-Communication-Module-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/75427; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdf
CVE: CVE-2015-0173
Published: 2015-06-28
Description: The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg21699547; http://www.securitytracker.com/id/1032630; http://www-01.ibm.com/support/docview.wss?uid=swg21699547
CVE: CVE-2015-1884
Published: 2015-06-28
Description: Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52957; http://www-01.ibm.com/support/docview.wss?uid=swg21700831; http://www.securityfocus.com/bid/75360
CVE: CVE-2015-1901
Published: 2015-06-28
Description: The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52549; http://www-01.ibm.com/support/docview.wss?uid=swg21701436; http://www.securityfocus.com/bid/75162
CVE: CVE-2015-1981
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4, when Webmail is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH9WYPR5.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Jun/56; http://www-01.ibm.com/support/docview.wss?uid=swg21959908; http://www.securityfocus.com/bid/74908
CVE: CVE-2015-5078
Published: 2015-06-28
Description: SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/75440; https://bugs.limesurvey.org/plugin.php?page=Source/view&id=15509; https://bugs.limesurvey.org/view.php?id=9720
CVE: CVE-2015-1959
Published: 2015-06-28
Description: IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/75442; http://www.securitytracker.com/id/1032734
CVE: CVE-2015-1972
Published: 2015-06-28
Description: IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/75441; http://www.securitytracker.com/id/1032734
CVE: CVE-2015-1974
Published: 2015-06-28
Description: The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/75438; http://www.securitytracker.com/id/1032734
CVE: CVE-2015-1978
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/75435; http://www.securitytracker.com/id/1032734
CVE: CVE-2015-2019
Published: 2015-06-28
Description: IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-17
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/75437; http://www.securitytracker.com/id/1032734
CVE: CVE-2014-9230
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/75288; http://www.securitytracker.com/id/1032710; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00
CVE: CVE-2015-0549
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/bugtraq/2015/Jun/113; http://www.securitytracker.com/id/1032693; http://seclists.org/bugtraq/2015/Jun/113
CVE: CVE-2015-0550
Published: 2015-06-28
Description: Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P01 allows remote attackers to bypass intended Content Server access restrictions via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/bugtraq/2015/Jun/114; http://www.securitytracker.com/id/1032694; http://seclists.org/bugtraq/2015/Jun/114
CVE: CVE-2015-1485
Published: 2015-06-28
Description: Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/75289; http://www.securitytracker.com/id/1032710; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00
CVE: CVE-2015-2965
Published: 2015-06-28
Description: Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN96312698/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000091; http://www.bitscope.co.jp/tep/news.html
CVE: CVE-2014-4768
Published: 2015-06-28
Description: IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode.
CVSS Score: 2.1 (LOW)
References: http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098278; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098278
CVE: CVE-2015-0115
Published: 2015-06-28
Description: Cross-site request forgery (CSRF) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21902807; http://www-01.ibm.com/support/docview.wss?uid=swg21902807
CVE: CVE-2015-0116
Published: 2015-06-28
Description: IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-74
References: http://www-01.ibm.com/support/docview.wss?uid=swg21902807; http://www-01.ibm.com/support/docview.wss?uid=swg21902807
CVE: CVE-2015-0118
Published: 2015-06-28
Description: IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725; http://www-01.ibm.com/support/docview.wss?uid=swg21957998; http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725
CVE: CVE-2015-0126
Published: 2015-06-28
Description: IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension.
CVSS Score: 6.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21902807; http://www-01.ibm.com/support/docview.wss?uid=swg21902807
CVE: CVE-2015-0127
Published: 2015-06-28
Description: IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted web site.
CVSS Score: 3.5 (LOW)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21902807; http://www-01.ibm.com/support/docview.wss?uid=swg21902807
CVE: CVE-2015-0131
Published: 2015-06-28
Description: Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21902807; http://www-01.ibm.com/support/docview.wss?uid=swg21902807
CVE: CVE-2015-0196
Published: 2015-06-29
Description: CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR51324; http://www-01.ibm.com/support/docview.wss?uid=swg1JR52306; http://www-01.ibm.com/support/docview.wss?uid=swg21960181
CVE: CVE-2015-0545
Published: 2015-06-29
Description: EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/bugtraq/2015/Jun/129; http://www.securitytracker.com/id/1032732; http://seclists.org/bugtraq/2015/Jun/129
CVE: CVE-2015-1900
Published: 2015-06-29
Description: IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52770; http://www-01.ibm.com/support/docview.wss?uid=swg21902280; http://www.securityfocus.com/bid/75481
CVE: CVE-2015-1913
Published: 2015-06-30
Description: Rational Test Control Panel in IBM Rational Test Workbench and Rational Test Virtualization Server 8.0.0.x before 8.0.0.5, 8.0.1.x before 8.0.1.6, 8.5.0.x before 8.5.0.4, 8.5.1.x before 8.5.1.5, 8.6.0.x before 8.6.0.4, and 8.7.0.x before 8.7.0.2 uses the MD5 algorithm for password hashing, which makes it easier for remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959298; http://www.securityfocus.com/bid/75307; http://www-01.ibm.com/support/docview.wss?uid=swg21959298
CVE: CVE-2015-4227
Published: 2015-06-30
Description: Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91838.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39555; http://www.securityfocus.com/bid/75465; http://www.securitytracker.com/id/1032747
CVE: CVE-2015-4229
Published: 2015-06-30
Description: The web framework in Cisco Unified Communications Domain Manager 8.1(4)ER1 allows remote attackers to obtain sensitive information by visiting a bvsmweb URL, aka Bug ID CSCuq22589.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39557; http://www.securityfocus.com/bid/75473; http://www.securitytracker.com/id/1032749
CVE: CVE-2014-9734
Published: 2015-06-30
Description: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marketblog.envato.com/news/affected-themes/; http://marketblog.envato.com/news/plugin-vulnerability/; http://packetstormsecurity.com/files/132366/WordPress-Revslider-4.2.2-XSS-Information-Disclosure.html
CVE: CVE-2014-9735
Published: 2015-06-30
Description: The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Nov/78; http://www.securityfocus.com/bid/71306; http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/
CVE: CVE-2015-5148
Published: 2015-06-30
Description: SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/37325/; https://www.exploit-db.com/exploits/37325/
CVE: CVE-2015-5149
Published: 2015-06-30
Description: Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132376/ManageEngine-SupportCenter-Plus-7.90-XSS-Traversal-Password-Disclosure.html; http://www.securityfocus.com/bid/75512; http://www.vulnerability-lab.com/get_content.php?id=1501
CVE: CVE-2015-5150
Published: 2015-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132376/ManageEngine-SupportCenter-Plus-7.90-XSS-Traversal-Password-Disclosure.html; http://www.vulnerability-lab.com/get_content.php?id=1501; https://www.exploit-db.com/exploits/37322/
CVE: CVE-2015-5151
Published: 2015-06-30
Description: Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132366/WordPress-Revslider-4.2.2-XSS-Information-Disclosure.html; http://www.securityfocus.com/bid/75303; http://packetstormsecurity.com/files/132366/WordPress-Revslider-4.2.2-XSS-Information-Disclosure.html
CVE: CVE-2015-1919
Published: 2015-06-30
Description: Cross-site scripting (XSS) vulnerability in IBM Security QRadar Incident Forensics before 7.2.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960011; http://www.securityfocus.com/bid/75209; http://www-01.ibm.com/support/docview.wss?uid=swg21960011
CVE: CVE-2015-1923
Published: 2015-06-30
Description: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75445; http://www.securitytracker.com/id/1032773
CVE: CVE-2015-1924
Published: 2015-06-30
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959398; http://www.securityfocus.com/bid/75447; http://www.securitytracker.com/id/1032773