deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3897
Published: 2015-06-18
Description: Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html; http://www.securityfocus.com/archive/1/535733/100/0/threaded; https://www.htbridge.com/advisory/HTB23259
CVE: CVE-2015-4139
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/05/29/1; http://www.openwall.com/lists/oss-security/2015/05/31/2; http://www.securityfocus.com/bid/74914
CVE: CVE-2015-4140
Published: 2015-06-18
Description: Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/05/29/1; http://www.openwall.com/lists/oss-security/2015/05/31/2; http://www.securityfocus.com/bid/74914
CVE: CVE-2015-4420
Published: 2015-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) crafted check plugin, the (2) description in a host profile, or the (3) plugin_args parameter to a Test service check page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/75223; https://www.exploit-db.com/exploits/37271/; http://www.securityfocus.com/bid/75223
CVE: CVE-2015-4587
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in the Alcatel-Lucent CellPipe 7130 router with firmware 1.0.0.20h.HOL allows remote attackers to inject arbitrary web script or HTML via the "Custom application" field in the "port triggering" menu.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132327/CellPipe-7130-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/75305; http://packetstormsecurity.com/files/132327/CellPipe-7130-Cross-Site-Scripting.html
CVE: CVE-2015-4654
Published: 2015-06-18
Description: SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132220/Joomla-EQ-Event-Calendar-SQL-Injection.html; http://www.securityfocus.com/bid/75261; http://packetstormsecurity.com/files/132220/Joomla-EQ-Event-Calendar-SQL-Injection.html
CVE: CVE-2015-4655
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/May/109; http://www.securityfocus.com/bid/74811; https://www.securify.nl/advisory/SFY20150503/reflected_cross_site_scripting_in_synology_diskstation_manager.html
CVE: CVE-2015-4656
Published: 2015-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/May/110; http://www.securityfocus.com/bid/74816; https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html
CVE: CVE-2015-4657
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in Mailbird 2.0.16.0 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/May/42; http://seclists.org/fulldisclosure/2015/May/98; http://www.securityfocus.com/bid/74815
CVE: CVE-2015-4658
Published: 2015-06-18
Description: Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/37290/; https://www.exploit-db.com/exploits/37290/
CVE: CVE-2015-4659
Published: 2015-06-18
Description: Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/75300; https://www.exploit-db.com/exploits/37266/; http://www.securityfocus.com/bid/75300
CVE: CVE-2015-4660
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML via the id parameter to iframe.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt; http://packetstormsecurity.com/files/132122/Enhanced-SQL-Portal-5.0.7961-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535661/100/0/threaded
CVE: CVE-2015-4661
Published: 2015-06-18
Description: Cross-site scripting (XSS) vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort parameter to system/authors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt; http://packetstormsecurity.com/files/132193/Symphony-CMS-2.6.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535714/100/0/threaded
CVE: CVE-2015-4191
Published: 2015-06-19
Description: Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet, aka Bug ID CSCuq95565.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39383; http://www.securityfocus.com/bid/75260; http://www.securitytracker.com/id/1032615
CVE: CVE-2015-4194
Published: 2015-06-19
Description: The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39420; http://www.securityfocus.com/bid/75296; http://www.securitytracker.com/id/1032660
CVE: CVE-2015-4195
Published: 2015-06-19
Description: Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39402; http://www.securityfocus.com/bid/75295; http://www.securitytracker.com/id/1032661
CVE: CVE-2015-2797
Published: 2015-06-19
Description: Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/120335; http://www.bmicrosystems.com/blog/exploiting-the-airties-air-series/; http://www.securityfocus.com/bid/75355
CVE: CVE-2015-2865
Published: 2015-06-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-4640, CVE-2015-4641.  Reason: this ID was intended for one issue, but was associated with two issues.  Notes: All CVE users should consult CVE-2015-4640 and CVE-2015-4641 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-4640
Published: 2015-06-19
Description: The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response.  NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
CVSS Score: 2.9 (LOW)
CWE: CWE-254
References: http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remote-bugging-devices/; http://www.kb.cert.org/vuls/id/155412; http://www.securityfocus.com/bid/75347
CVE: CVE-2015-4641
Published: 2015-06-19
Description: Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a ZIP archive, as demonstrated by a traversal to the /data/dalvik-cache directory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remote-bugging-devices/; http://www.kb.cert.org/vuls/id/155412; http://www.securityfocus.com/bid/75353
CVE: CVE-2015-4675
Published: 2015-06-19
Description: Buffer overflow in the Tiny SRP library (aka TinySRP) allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted size value for the username field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/132196/TinySRP-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2015/Jun/21; http://www.securityfocus.com/bid/75365
CVE: CVE-2015-4676
Published: 2015-06-19
Description: SQL injection vulnerability in ticket.php in TickFa 1.x allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a read action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132186/TickFa-1.x-SQL-Injection.html; http://www.securityfocus.com/bid/75343; http://packetstormsecurity.com/files/132186/TickFa-1.x-SQL-Injection.html
CVE: CVE-2015-4677
Published: 2015-06-19
Description: Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijack the authentication of administrators for requests that create a new admin via a request to administrator/admins_create.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/75312; https://www.exploit-db.com/exploits/37257/; http://www.securityfocus.com/bid/75312
CVE: CVE-2015-4678
Published: 2015-06-19
Description: SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132216/Persian-Car-CMS-1.0-SQL-Injection.html; http://www.securityfocus.com/bid/75345; http://packetstormsecurity.com/files/132216/Persian-Car-CMS-1.0-SQL-Injection.html
CVE: CVE-2015-4679
Published: 2015-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Airties RT-210 allow remote attackers to inject arbitrary web script or HTML via the (1) ddns_domainame or (2) ddns_account parameter to ddns.stm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132178/Airties-RT210-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/75342; http://packetstormsecurity.com/files/132178/Airties-RT210-Cross-Site-Scripting.html
CVE: CVE-2015-4201
Published: 2015-06-20
Description: The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header, aka Bug ID CSCut68058.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39431; http://www.securityfocus.com/bid/75323; http://www.securitytracker.com/id/1032677
CVE: CVE-2015-2723
Published: 2015-06-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-4000.  Reason: This candidate is a duplicate of CVE-2015-4000.  Notes: All CVE users should reference CVE-2015-4000 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-4197
Published: 2015-06-20
Description: Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network, aka Bug ID CSCud89415.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39421; http://www.securityfocus.com/bid/75324; http://www.securitytracker.com/id/1032675
CVE: CVE-2015-4198
Published: 2015-06-20
Description: Cross-site scripting (XSS) vulnerability in the web framework on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39422; http://www.securityfocus.com/bid/75326; http://www.securitytracker.com/id/1032676
CVE: CVE-2015-4202
Published: 2015-06-20
Description: Cisco IOS 12.2SCH on uBR10000 router Cable Modem Termination Systems (CMTS) does not properly restrict access to the IP Detail Record (IPDR) service, which allows remote attackers to obtain potentially sensitive MAC address and network-utilization information via crafted IPDR packets, aka Bug ID CSCua39203.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39432; http://www.securityfocus.com/bid/75321; http://www.securitytracker.com/id/1032678
CVE: CVE-2015-0526
Published: 2015-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to inject arbitrary web script or HTML via the (1) displayMode or (2) wrapPreDisplayMode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2015/Jun/88; http://www.securitytracker.com/id/1032590; http://seclists.org/bugtraq/2015/Jun/88
CVE: CVE-2015-4590
Published: 2015-06-22
Description: The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/06/16/6; http://www.securityfocus.com/bid/75150; https://github.com/bblanchon/ArduinoJson/blob/master/CHANGELOG.md
CVE: CVE-2015-4713
Published: 2015-06-22
Description: SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132369/ApPHP-Hotel-Site-3.x.x-SQL-Injection.html; http://www.securityfocus.com/bid/75390; http://packetstormsecurity.com/files/132369/ApPHP-Hotel-Site-3.x.x-SQL-Injection.html
CVE: CVE-2015-4714
Published: 2015-06-22
Description: Cross-site scripting (XSS) vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode parameter to /body.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132214/DreamBox-DM500s-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/75388; http://packetstormsecurity.com/files/132214/DreamBox-DM500s-Cross-Site-Scripting.html
CVE: CVE-2015-3231
Published: 2015-06-22
Description: The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html; http://www.debian.org/security/2015/dsa-3291
CVE: CVE-2015-3232
Published: 2015-06-22
Description: Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html; http://www.debian.org/security/2015/dsa-3291
CVE: CVE-2015-3233
Published: 2015-06-22
Description: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html; http://www.debian.org/security/2015/dsa-3291
CVE: CVE-2015-3234
Published: 2015-06-22
Description: The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html; http://www.debian.org/security/2015/dsa-3291
CVE: CVE-2015-3236
Published: 2015-06-22
Description: cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://curl.haxx.se/docs/adv_20150617A.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2015-3237
Published: 2015-06-22
Description: The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://curl.haxx.se/docs/adv_20150617B.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2015-4200
Published: 2015-06-23
Description: Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39424; http://www.securityfocus.com/bid/75254; http://www.securitytracker.com/id/1032692
CVE: CVE-2015-4204
Published: 2015-06-23
Description: Memory leak in Cisco IOS 12.2 in the Performance Routing Engine (PRE) module on uBR10000 devices allows remote authenticated users to cause a denial of service (memory consumption or PXF process crash) by sending docsIfMCmtsMib SNMP requests quickly, aka Bug ID CSCue65051.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39440; http://www.securityfocus.com/bid/75337; http://www.securitytracker.com/id/1032692
CVE: CVE-2015-4189
Published: 2015-06-23
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Data Center Analytics Framework (DCAF) 1.4 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun26807.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39377; http://www.securityfocus.com/bid/75349; http://tools.cisco.com/security/center/viewAlert.x?alertId=39377
CVE: CVE-2015-4203
Published: 2015-06-23
Description: Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine (PRE) module on uBR10000 devices, when NetFlow and an MPLS IPv6 VPN are configured, allows remote attackers to cause a denial of service (PXF process crash) by sending malformed MPLS 6VPE packets quickly, aka Bug ID CSCud83396.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-362
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39439; http://www.securityfocus.com/bid/75339; http://www.securitytracker.com/id/1032692
CVE: CVE-2015-4205
Published: 2015-06-23
Description: Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE frames on the local network, aka Bug ID CSCut19959.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39455; http://www.securityfocus.com/bid/75352; http://www.securitytracker.com/id/1032691
CVE: CVE-2015-4207
Published: 2015-06-23
Description: Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39457; http://www.securityfocus.com/bid/75350; http://www.securitytracker.com/id/1032705
CVE: CVE-2015-4209
Published: 2015-06-23
Description: Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain sensitive information by obtaining a list of all meetings and then sending a calendar request for each one, aka Bug ID CSCur23913.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39459; http://www.securityfocus.com/bid/75351; http://www.securitytracker.com/id/1032705
CVE: CVE-2015-4210
Published: 2015-06-23
Description: Cross-site scripting (XSS) vulnerability in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur03806.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39460; http://www.securityfocus.com/bid/75348; http://www.securitytracker.com/id/1032705