deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7776
Published: 2016-06-19
Description: Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN53542912/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000085; https://support.cybozu.com/ja-jp/article/8757
CVE: CVE-2016-0392
Published: 2016-06-19
Description: IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875; http://www-01.ibm.com/support/docview.wss?uid=swg1IV84206
CVE: CVE-2016-0911
Published: 2016-06-19
Description: EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Jun/50; http://www.securitytracker.com/id/1036079; http://seclists.org/bugtraq/2016/Jun/50
CVE: CVE-2016-0912
Published: 2016-06-19
Description: EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Jun/50; http://www.securitytracker.com/id/1036079; http://seclists.org/bugtraq/2016/Jun/50
CVE: CVE-2016-1191
Published: 2016-06-19
Description: Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN14749391/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000078; https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03
CVE: CVE-2016-1192
Published: 2016-06-19
Description: Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-200
References: http://jvn.jp/en/jp/JVN14749391/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000095; https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03
CVE: CVE-2016-1196
Published: 2016-06-19
Description: Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://jvn.jp/en/jp/JVN33879831/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000082; https://support.cybozu.com/ja-jp/article/8970
CVE: CVE-2016-1860
Published: 2016-06-19
Description: Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-254
References: http://lists.apple.com/archives/security-announce/2016/May/msg00004.html; https://support.apple.com/HT206567; http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
CVE: CVE-2016-1861
Published: 2016-06-19
Description: The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1846.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/May/msg00004.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=724; https://support.apple.com/HT206567
CVE: CVE-2016-1862
Published: 2016-06-19
Description: Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-254
References: http://lists.apple.com/archives/security-announce/2016/May/msg00004.html; https://support.apple.com/HT206567; http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
CVE: CVE-2016-1864
Published: 2016-06-19
Description: The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html; http://www.securityfocus.com/bid/91358
CVE: CVE-2016-4514
Published: 2016-06-19
Description: Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy.
CVSS Score: 7.7 (HIGH)
CWE: CWE-863
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-168-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-168-01
CVE: CVE-2016-4518
Published: 2016-06-19
Description: OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-166-02; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00301; https://ics-cert.us-cert.gov/advisories/ICSA-16-166-02
CVE: CVE-2016-4530
Published: 2016-06-19
Description: OSIsoft PI SQL Data Access Server (aka OLE DB) 2016 1.5 allows remote authenticated users to cause a denial of service (service outage and data loss) via a message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-166-01; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00300; https://ics-cert.us-cert.gov/advisories/ICSA-16-166-01
CVE: CVE-2016-4811
Published: 2016-06-19
Description: The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attackers to obtain API access via unspecified vectors.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN46888319/278948/index.html; http://jvn.jp/en/jp/JVN46888319/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000076
CVE: CVE-2015-8288
Published: 2016-06-20
Description: NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS Score: 5.9 (MEDIUM)
References: http://kb.netgear.com/app/answers/detail/a_id/30560; http://www.kb.cert.org/vuls/id/778696; http://kb.netgear.com/app/answers/detail/a_id/30560
CVE: CVE-2015-8289
Published: 2016-06-20
Description: The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-255
References: http://kb.netgear.com/app/answers/detail/a_id/30490; http://www.kb.cert.org/vuls/id/778696; http://kb.netgear.com/app/answers/detail/a_id/30490
CVE: CVE-2016-2177
Published: 2016-06-20
Description: OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
CVE: CVE-2016-2178
Published: 2016-06-20
Description: The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: http://eprint.iacr.org/2016/594.pdf; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
CVE: CVE-2016-2362
Published: 2016-06-20
Description: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.
CVSS Score: 9.8 (CRITICAL)
References: http://www.kb.cert.org/vuls/id/754056; http://www.kb.cert.org/vuls/id/754056
CVE: CVE-2016-2363
Published: 2016-06-20
Description: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/754056; http://www.kb.cert.org/vuls/id/754056
CVE: CVE-2016-2364
Published: 2016-06-20
Description: The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/754056; http://www.kb.cert.org/vuls/id/754056
CVE: CVE-2015-6289
Published: 2016-06-23
Description: Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets on the SSH port, aka Bug ID CSCuu13476.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-isr; http://www.securityfocus.com/bid/91322; http://www.securitytracker.com/id/1036141
CVE: CVE-2016-0914
Published: 2016-06-23
Description: EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended access restrictions and execute arbitrary IAPI/IDQL commands via the IAPI/IDQL interface.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/bugtraq/2016/Jun/92; http://www.securitytracker.com/id/1036153; http://seclists.org/bugtraq/2016/Jun/92
CVE: CVE-2016-1428
Published: 2016-06-23
Description: Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device restart) via a sequence of crafted SNMP read requests, aka Bug ID CSCux13174.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-iosxe; http://www.securitytracker.com/id/1036140; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-iosxe
CVE: CVE-2016-1434
Published: 2016-06-23
Description: The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an invalid file, aka Bug ID CSCuz03010.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ip-phone; http://www.securitytracker.com/id/1036139; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ip-phone
CVE: CVE-2016-1435
Published: 2016-06-23
Description: Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, which allows local users to write to arbitrary files by leveraging shell access, aka Bug ID CSCuz03014.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ipp; http://www.securitytracker.com/id/1036138; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ipp
CVE: CVE-2016-1436
Published: 2016-06-23
Description: The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on Cisco ASR 5000 Packet Data Network Gateway devices before 19.4 allows remote attackers to cause a denial of service (Session Manager process restart) via a crafted GTPv1 packet, aka Bug ID CSCuz46198.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160621-asr; http://www.securitytracker.com/id/1036152; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160621-asr
CVE: CVE-2016-1437
Published: 2016-06-23
Description: SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy92549.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160621-pcd; http://www.securitytracker.com/id/1036151; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160621-pcd
CVE: CVE-2016-1438
Published: 2016-06-23
Description: Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a ZIP archive, aka Bug ID CSCuy39210.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-254
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160622-esa; http://www.securitytracker.com/id/1036156; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160622-esa
CVE: CVE-2016-1439
Published: 2016-06-23
Description: Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Contact Center Enterprise through 10.5(2) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux59650.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160622-ucce; http://www.securitytracker.com/id/1036155; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160622-ucce
CVE: CVE-2016-4802
Published: 2016-06-24
Description: Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/90997; http://www.securitytracker.com/id/1036008; https://curl.haxx.se/docs/adv_20160530.html
CVE: CVE-2016-5021
Published: 2016-06-24
Description: The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 allows remote authenticated administrators to obtain sensitive information via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036172; https://support.f5.com/kb/en-us/solutions/public/k/99/sol99998454/; http://www.securitytracker.com/id/1036172
CVE: CVE-2016-5435
Published: 2016-06-24
Description: Memory leak in Huawei IPS Module, NGFW Module, NIP6300, NIP6600, and Secospace USG6300, USG6500, USG6600, USG9500, and AntiDDoS8000 V500R001C00 before V500R001C20SPC100, when in hot standby networking where two devices are not directly connected, allows remote attackers to cause a denial of service (memory consumption and reboot) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-standby-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-standby-en
CVE: CVE-2016-5709
Published: 2016-06-24
Description: SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges to obtain user passwords via a brute force attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/137525/Solarwinds-Virtualization-Manager-6.3.1-Weak-Crypto.html; http://seclists.org/fulldisclosure/2016/Jun/38; http://packetstormsecurity.com/files/137525/Solarwinds-Virtualization-Manager-6.3.1-Weak-Crypto.html
CVE: CVE-2016-5722
Published: 2016-06-24
Description: Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network.
CVSS Score: 7.3 (HIGH)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-oceanstor-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-oceanstor-en
CVE: CVE-2016-5723
Published: 2016-06-24
Description: Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160617-01-fusioninsight-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160617-01-fusioninsight-en
CVE: CVE-2016-4519
Published: 2016-06-25
Description: Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91402; http://zerodayinitiative.com/advisories/ZDI-16-375/; https://ics-cert.us-cert.gov/advisories/ICSA-16-175-02
CVE: CVE-2016-4525
Published: 2016-06-25
Description: Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.
CVSS Score: 6.6 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01
CVE: CVE-2016-4528
Published: 2016-06-25
Description: Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01
CVE: CVE-2016-1188
Published: 2016-06-25
Description: Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://jvn.jp/en/jp/JVN18975349/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000077; https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03
CVE: CVE-2016-1189
Published: 2016-06-25
Description: Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
CVSS Score: 8.1 (HIGH)
References: http://jvn.jp/en/jp/JVN18975349/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000093; https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03
CVE: CVE-2016-1190
Published: 2016-06-25
Description: Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN18975349/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000094; https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03
CVE: CVE-2016-1193
Published: 2016-06-25
Description: Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN25765762/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000079; https://support.cybozu.com/ja-jp/article/8919
CVE: CVE-2016-4822
Published: 2016-06-25
Description: Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: http://corega.jp/support/security/20160622_wlbargl.htm; http://jvn.jp/en/jp/JVN76653039/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000107
CVE: CVE-2016-4823
Published: 2016-06-25
Description: Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://corega.jp/support/security/20160622_wlbaragm.htm; http://jvn.jp/en/jp/JVN24409899/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000108
CVE: CVE-2016-4824
Published: 2016-06-25
Description: The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authentication attempts, which makes it easier for remote attackers to obtain network access via a brute-force attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://corega.jp/support/security/20160622_wlr300gnv.htm; http://jvn.jp/en/jp/JVN75028871/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000109
CVE: CVE-2016-4825
Published: 2016-06-25
Description: The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN47363774/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000115; http://www.welcart.com/community/archives/78977
CVE: CVE-2016-4826
Published: 2016-06-25
Description: Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN95082904/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000116; http://www.welcart.com/community/archives/78977
CVE: CVE-2016-4827
Published: 2016-06-25
Description: Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55826471/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000117; http://www.welcart.com/community/archives/78977