deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9468
Published: 2015-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in InstantASP InstantForum.NET 4.1.3, 4.1.2, 4.1.1, 4.0.0, 4.1.0, and 3.4.0 allow remote attackers to inject arbitrary web script or HTML via the SessionID parameter to (1) Join.aspx or (2) Logon.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Feb/70; http://tetraph.com/security/cves/cve-2014-9468-instantasp-instantforum-net-multiple-xss-cross-site-scripting-security-vulnerabilities/; http://www.securitytracker.com/id/1033434
CVE: CVE-2014-9679
Published: 2015-02-19
Description: Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0067.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150171.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150177.html
CVE: CVE-2015-1197
Published: 2015-02-19
Description: cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
CVSS Score: 1.9 (LOW)
References: http://advisories.mageia.org/MGASA-2015-0080.html; http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html; http://www.mandriva.com/security/advisories?name=MDVSA-2015:066
CVE: CVE-2015-1515
Published: 2015-02-19
Description: The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x00222000, 0x00222004, 0x00222008, 0x0022200c, or 0x00222010 IOCTL call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/36052; http://www.osvdb.org/117996; http://www.exploit-db.com/exploits/36052
CVE: CVE-2015-1585
Published: 2015-02-19
Description: Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/archive/1/534709/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/100925
CVE: CVE-2015-1587
Published: 2015-02-19
Description: Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/.
CVSS Score: 7.5 (HIGH)
References: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html; http://osvdb.org/show/osvdb/113928; http://packetstormsecurity.com/files/130383/Maarch-LetterBox-2.8-Unrestricted-File-Upload.html
CVE: CVE-2015-1592
Published: 2015-02-19
Description: Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2015/02/12/17; http://www.openwall.com/lists/oss-security/2015/02/12/2; http://www.securityfocus.com/bid/72606
CVE: CVE-2015-1603
Published: 2015-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html; http://seclists.org/fulldisclosure/2015/Feb/50; http://sroesemann.blogspot.de/2015/01/sroeadv-2015-14.html
CVE: CVE-2015-1604
Published: 2015-02-19
Description: Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html; http://seclists.org/fulldisclosure/2015/Feb/50; http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html
CVE: CVE-2015-1614
Published: 2015-02-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) image_metadata_cruncher[alt] or (2) image_metadata_cruncher[caption] parameter in an update action in the image_metadata_cruncher_title page to wp-admin/options.php or (3) custom image meta tag to the image metadata cruncher page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130404/WordPress-Image-Metadata-Cruncher-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534711/100/0/threaded; http://www.securityfocus.com/archive/1/534718/100/0/threaded
CVE: CVE-2015-1879
Published: 2015-02-19
Description: Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/72547; https://wordpress.org/plugins/google-document-embedder/changelog/
CVE: CVE-2014-3578
Published: 2015-02-19
Description: Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN49154900/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054; http://pivotal.io/security/cve-2014-3578
CVE: CVE-2013-6500
Published: 2015-02-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2015-0584
Published: 2015-02-20
Description: The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter, aka Bug ID CSCus38947.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0584; http://www.securityfocus.com/bid/72696; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0584
CVE: CVE-2015-0628
Published: 2015-02-20
Description: The proxy engine on Cisco Web Security Appliance (WSA) devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0628; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0628
CVE: CVE-2014-5355
Published: 2015-02-20
Description: MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
CVSS Score: 5.0 (MEDIUM)
References: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050; http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html; http://rhn.redhat.com/errata/RHSA-2015-0794.html
CVE: CVE-2015-0878
Published: 2015-02-20
Description: Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN77294617/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000020; http://www.almail.com/vulnerability.html
CVE: CVE-2015-0879
Published: 2015-02-20
Description: CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN55365709/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000021; http://www.almail.com/vulnerability.html
CVE: CVE-2015-0880
Published: 2015-02-20
Description: Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN93318392/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000022; http://www.almail.com/vulnerability.html
CVE: CVE-2015-0881
Published: 2015-02-20
Description: CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN64455813/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000019; http://jvn.jp/en/jp/JVN64455813/index.html
CVE: CVE-2015-2033
Published: 2015-02-20
Description: Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://unsecurityresearch.com/index.php?option=com_content&view=article&id=46&Itemid=53; http://www.securityfocus.com/bid/73423; https://support.infoblox.com/app/answers/detail/a_id/3666/kw/NETMRI-23483
CVE: CVE-2014-0005
Published: 2015-02-20
Description: PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2014-0343.html; http://rhn.redhat.com/errata/RHSA-2014-0344.html; http://rhn.redhat.com/errata/RHSA-2014-0345.html
CVE: CVE-2014-3682
Published: 2015-02-20
Description: XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-0234.html; http://rhn.redhat.com/errata/RHSA-2015-0235.html; https://github.com/droolsjbpm/jbpm-designer/commit/5641588c730cc75dc3b76c34b76271fbd407fb84
CVE: CVE-2014-8114
Published: 2015-02-20
Description: The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0234.html; http://rhn.redhat.com/errata/RHSA-2015-0235.html; http://www.securityfocus.com/bid/88199
CVE: CVE-2014-8115
Published: 2015-02-20
Description: The default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to read or write to arbitrary files, bypass intended access restrictions, and possibly have other unspecified impact via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2015-0234.html; http://rhn.redhat.com/errata/RHSA-2015-0235.html; https://github.com/droolsjbpm/kie-wb-distributions/commit/90eed433d3
CVE: CVE-2015-0167
Published: 2015-02-20
Description: Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/100929; https://github.com/fraywing/textAngular/releases/tag/v1.3.7; https://exchange.xforce.ibmcloud.com/vulnerabilities/100929
CVE: CVE-2015-1517
Published: 2015-02-20
Description: SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130440/Piwigo-2.7.3-SQL-Injection.html; http://piwigo.org/forum/viewtopic.php?id=25179; http://piwigo.org/releases/2.7.4
CVE: CVE-2015-2034
Published: 2015-02-20
Description: Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html; http://piwigo.org/forum/viewtopic.php?id=25179; http://piwigo.org/releases/2.7.4
CVE: CVE-2015-2035
Published: 2015-02-20
Description: SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html; http://piwigo.org/forum/viewtopic.php?id=25179; http://piwigo.org/releases/2.7.4
CVE: CVE-2015-2039
Published: 2015-02-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130306/WordPress-Acobot-Live-Chat-And-Contact-Form-2.0-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/100813; https://exchange.xforce.ibmcloud.com/vulnerabilities/100814
CVE: CVE-2015-2040
Published: 2015-02-20
Description: Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130311/WordPress-Contact-Form-DB-2.8.26-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/100818; http://packetstormsecurity.com/files/130311/WordPress-Contact-Form-DB-2.8.26-Cross-Site-Scripting.html
CVE: CVE-2015-2010
Published: 2015-02-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-0010.  Reason: This candidate is a duplicate of CVE-2015-0010.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2015-0010 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-0331
Published: 2015-02-21
Description: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html; http://www.securityfocus.com/bid/72698; https://helpx.adobe.com/security/products/flash-player/apsb15-04.html
CVE: CVE-2015-0618
Published: 2015-02-21
Description: Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241.
CVSS Score: 7.1 (HIGH)
CWE: CWE-19
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150220-ipv6; http://www.securityfocus.com/bid/72713; http://www.securitytracker.com/id/1031778
CVE: CVE-2015-0624
Published: 2015-02-21
Description: The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/130525/Cisco-Ironport-AsyncOS-HTTP-Header-Injection.html; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0624; http://www.securityfocus.com/bid/72702
CVE: CVE-2015-0631
Published: 2015-02-21
Description: Race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade, aka Bug ID CSCui25688.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0631; http://www.securityfocus.com/bid/72700; http://www.securitytracker.com/id/1031780
CVE: CVE-2014-6184
Published: 2015-02-22
Description: Stack-based buffer overflow in dsmtca in the client in IBM Tivoli Storage Manager (TSM) 5.4 through 5.4.3.6, 5.5 through 5.5.4.3, 6.1 through 6.1.5.6, 6.2 before 6.2.5.4, and 6.3 before 6.3.2.3 on UNIX, Linux, and OS X allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT05707; http://www-01.ibm.com/support/docview.wss?uid=swg21695878; http://www-01.ibm.com/support/docview.wss?uid=swg1IT05707
CVE: CVE-2014-7922
Published: 2015-02-23
Description: The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding _opt_ parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes including the SID and LSID scopes, and consequently obtain access to a Google account, via a crafted application, as demonstrated by setting the has_permission=1 parameter value upon finding _opt_has_permission in that argument.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://isciurus.blogspot.com/2015/01/android-app-with-full-control-over-your.html; https://gist.github.com/isciurus/df4d7edd9c3efb4a0753; http://isciurus.blogspot.com/2015/01/android-app-with-full-control-over-your.html
CVE: CVE-2015-1315
Published: 2015-02-23
Description: Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.conostix.com/pub/adv/CVE-2015-1315-Info-ZIP-unzip-Out-of-bounds_Write.txt; http://www.openwall.com/lists/oss-security/2015/02/17/4; http://www.ubuntu.com/usn/USN-2502-1
CVE: CVE-2015-1426
Published: 2015-02-23
Description: Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://puppetlabs.com/security/cve/cve-2015-1426; http://puppetlabs.com/security/cve/cve-2015-1426
CVE: CVE-2015-1589
Published: 2015-02-23
Description: Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/02/12/16; http://www.openwall.com/lists/oss-security/2015/02/12/9; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776164
CVE: CVE-2015-2047
Published: 2015-02-23
Description: The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to an empty value.
CVSS Score: 2.6 (LOW)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00106.html; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-001/; http://www.debian.org/security/2015/dsa-3164
CVE: CVE-2015-2048
Published: 2015-02-23
Description: Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049
CVE: CVE-2015-2049
Published: 2015-02-23
Description: Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
CVSS Score: 9.0 (HIGH)
References: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049; http://www.kb.cert.org/vuls/id/377348; https://www.exploit-db.com/exploits/39192/
CVE: CVE-2015-2050
Published: 2015-02-23
Description: D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10050; http://www.kb.cert.org/vuls/id/184100; http://www.securityfocus.com/bid/73143
CVE: CVE-2015-2051
Published: 2015-02-23
Description: The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051; http://www.securityfocus.com/bid/72623; http://www.securityfocus.com/bid/74870
CVE: CVE-2015-2052
Published: 2015-02-23
Description: Stack-based buffer overflow in the DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary code via a long string in a GetDeviceSettings action to the HNAP interface.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051; http://www.securityfocus.com/bid/72623; http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051