deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6109
Published: 2015-11-11
Description: The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism, and consequently discover a driver base address, via a crafted application, aka "Windows Kernel Memory Information Disclosure Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1034114; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-115; http://www.securitytracker.com/id/1034114
CVE: CVE-2015-6111
Published: 2015-11-11
Description: IPSec in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles encryption negotiation, which allows remote authenticated users to cause a denial of service (system hang) via crafted IP traffic, aka "Windows IPSec Denial of Service Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://www.securitytracker.com/id/1034123; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-120; http://www.securitytracker.com/id/1034123
CVE: CVE-2015-6112
Published: 2015-11-11
Description: SChannel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 lacks the required extended master-secret binding support to ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack," aka "Schannel TLS Triple Handshake Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-310
References: http://www.securitytracker.com/id/1034124; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-121; http://www.securitytracker.com/id/1034124
CVE: CVE-2015-6113
Published: 2015-11-11
Description: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to bypass intended filesystem permissions by leveraging Low Integrity access, aka "Windows Kernel Security Feature Bypass Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-254
References: http://www.securitytracker.com/id/1034114; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-115; http://www.securitytracker.com/id/1034114
CVE: CVE-2015-6115
Published: 2015-11-11
Description: Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1034116; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-118; http://www.securitytracker.com/id/1034116
CVE: CVE-2015-6123
Published: 2015-11-11
Description: Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message that is mishandled by Outlook for Mac, aka "Microsoft Outlook for Mac Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/77525; http://www.securitytracker.com/id/1034122; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-116
CVE: CVE-2015-7651
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7652
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted gridFitType property value, a different vulnerability than CVE-2015-7651, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7653
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted globalToLocal arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7654
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted attachSound arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7655
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionExtends arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7656
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionImplementsOp arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7657
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionCallMethod arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7658
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionInstanceOf arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7659
Published: 2015-11-11
Description: Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7660
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted setMask arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7661
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted getBounds call, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7662
Published: 2015-11-11
Description: Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and write to files via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-7663
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-8042
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted loadSound call, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-8043
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8044, and CVE-2015-8046.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-8044
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8046.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-8046
Published: 2015-11-11
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8044.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-11/msg00071.html; http://rhn.redhat.com/errata/RHSA-2015-2023.html; http://rhn.redhat.com/errata/RHSA-2015-2024.html
CVE: CVE-2015-5441
Published: 2015-11-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP ArcSight Management Center before 2.1 and ArcSight Logger before 6.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN51046809/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-005909.html; http://www.securityfocus.com/archive/1/536877/100/0/threaded
CVE: CVE-2015-6363
Published: 2015-11-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco FireSIGHT Management Center (MC) 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151111-fmc; http://www.securitytracker.com/id/1034138; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151111-fmc
CVE: CVE-2015-6554
Published: 2015-11-12
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/77494; http://www.securitytracker.com/id/1034139; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00
CVE: CVE-2015-6555
Published: 2015-11-12
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/77495; http://www.securitytracker.com/id/1034139; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00
CVE: CVE-2015-7817
Published: 2015-11-12
Description: Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://www.zerodayinitiative.com/advisories/ZDI-15-553/; https://support.lenovo.com/us/en/product_security/len_2015_074; http://www.zerodayinitiative.com/advisories/ZDI-15-553/
CVE: CVE-2015-7818
Published: 2015-11-12
Description: The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.zerodayinitiative.com/advisories/ZDI-15-551/; https://support.lenovo.com/us/en/product_security/len_2015_074; http://www.zerodayinitiative.com/advisories/ZDI-15-551/
CVE: CVE-2015-7819
Published: 2015-11-12
Description: The DB service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain sensitive administrator-account information via a request on port 40999, as demonstrated by an improperly encrypted password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.zerodayinitiative.com/advisories/ZDI-15-552/; https://support.lenovo.com/us/en/product_security/len_2015_074; http://www.zerodayinitiative.com/advisories/ZDI-15-552/
CVE: CVE-2015-7820
Published: 2015-11-12
Description: Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://www.zerodayinitiative.com/advisories/ZDI-15-554/; https://support.lenovo.com/us/en/product_security/len_2015_074; http://www.zerodayinitiative.com/advisories/ZDI-15-554/
CVE: CVE-2015-8113
Published: 2015-11-12
Description: Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/bid/77585; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00; http://www.securityfocus.com/bid/77585
CVE: CVE-2015-2698
Published: 2015-11-13
Description: The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8273; http://lists.opensuse.org/opensuse-updates/2015-11/msg00116.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00124.html
CVE: CVE-2015-6045
Published: 2015-11-13
Description: Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript that improperly interacts with use of the Cascading Style Sheets (CSS) empty-cells property for a TABLE element, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.zerodayinitiative.com/advisories/ZDI-15-523; http://www.zerodayinitiative.com/advisories/ZDI-15-523/; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-106
CVE: CVE-2015-6366
Published: 2015-11-13
Description: Cisco IOS 15.2(04)M6 and 15.4(03)S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151112-ios2; http://www.securitytracker.com/id/1034141; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151112-ios2