deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5627
Published: 2020-02-05
Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01; http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf
CVE: CVE-2015-5628
Published: 2020-02-05
Description: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01; http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf
CVE: CVE-2010-5304
Published: 2020-02-05
Description: A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139814.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140219.html
CVE: CVE-2011-0220
Published: 2020-02-05
Description: Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://opensource.apple.com/source/mDNSResponder/mDNSResponder-541/mDNSPosix/ReadMe.txt; https://opensource.apple.com/source/mDNSResponder/mDNSResponder-541/mDNSPosix/ReadMe.txt
CVE: CVE-2019-20173
Published: 2020-02-05
Description: The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://auth0.com/docs/security/bulletins/cve-2019-20173; https://github.com/auth0/wp-auth0/releases/tag/3.11.3; https://wpvulndb.com/vulnerabilities/10059
CVE: CVE-2019-20447
Published: 2020-02-05
Description: Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/152503/Jobberbase-CMS-2.0-SQL-Injection.html; https://www.exploit-db.com/exploits/47311; https://packetstormsecurity.com/files/152503/Jobberbase-CMS-2.0-SQL-Injection.html
CVE: CVE-2011-1009
Published: 2020-02-05
Description: Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/02/22/14; https://www.openwall.com/lists/oss-security/2011/02/22/14
CVE: CVE-2011-1069
Published: 2020-02-05
Description: PHPShop through 0.8.1 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/02/28/9; https://www.openwall.com/lists/oss-security/2011/02/28/9
CVE: CVE-2013-2680
Published: 2020-02-05
Description: Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html; http://www.securityfocus.com/bid/59712; https://exchange.xforce.ibmcloud.com/vulnerabilities/84073
CVE: CVE-2013-2681
Published: 2020-02-05
Description: Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html; http://www.securityfocus.com/bid/59714; https://exchange.xforce.ibmcloud.com/vulnerabilities/84068
CVE: CVE-2013-2682
Published: 2020-02-05
Description: Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html; http://www.securityfocus.com/bid/59717; https://exchange.xforce.ibmcloud.com/vulnerabilities/84071
CVE: CVE-2020-6854
Published: 2020-02-05
Description: A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://change.sos-berlin.com/browse/JOC-854; https://change.sos-berlin.com/browse/JOC-854
CVE: CVE-2020-8641
Published: 2020-02-05
Description: Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/47985; https://www.exploit-db.com/exploits/47985
CVE: CVE-2011-1150
Published: 2020-02-05
Description: bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/03/14/20; https://www.openwall.com/lists/oss-security/2011/03/14/20
CVE: CVE-2011-1151
Published: 2020-02-05
Description: Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/101835/Joomla-1.6.0-SQL-Injection.html; https://www.openwall.com/lists/oss-security/2011/03/14/21; https://packetstormsecurity.com/files/101835/Joomla-1.6.0-SQL-Injection.html
CVE: CVE-2020-8644
Published: 2020-02-05
Description: PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html; https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704; https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/
CVE: CVE-2011-1517
Published: 2020-02-05
Description: SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Score: 9.8 (CRITICAL)
References: http://archives.neohapsis.com/archives/bugtraq/2012-05/0061.html; http://www.securityfocus.com/bid/53424; https://exchange.xforce.ibmcloud.com/vulnerabilities/75452
CVE: CVE-2011-1597
Published: 2020-02-06
Description: OpenVAS Manager v2.0.3 allows plugin remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.openwall.com/lists/oss-security/2011/04/20/5; https://www.openwall.com/lists/oss-security/2011/04/20/5
CVE: CVE-2020-8647
Published: 2020-02-06
Description: There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html; https://bugzilla.kernel.org/show_bug.cgi?id=206359; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
CVE: CVE-2020-8648
Published: 2020-02-06
Description: There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://bugzilla.kernel.org/show_bug.cgi?id=206361; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
CVE: CVE-2020-8649
Published: 2020-02-06
Description: There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html; https://bugzilla.kernel.org/show_bug.cgi?id=206357; https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
CVE: CVE-2019-20104
Published: 2020-02-06
Description: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://jira.atlassian.com/browse/CWD-5526; https://zeroauth.ltd/blog/2020/02/07/cve-2019-20104-atlassian-crowd-openid-client-vulnerable-to-remote-dos-via-xml-entity-expansion/; https://jira.atlassian.com/browse/CWD-5526
CVE: CVE-2019-20106
Published: 2020-02-06
Description: Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://jira.atlassian.com/browse/JRASERVER-70543; https://jira.atlassian.com/browse/JRASERVER-70543
CVE: CVE-2019-20400
Published: 2020-02-06
Description: The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jira.atlassian.com/browse/JRASERVER-70407; https://jira.atlassian.com/browse/JRASERVER-70407
CVE: CVE-2019-20401
Published: 2020-02-06
Description: Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-70406; https://jira.atlassian.com/browse/JRASERVER-70406
CVE: CVE-2019-20402
Published: 2020-02-06
Description: Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70564; https://jira.atlassian.com/browse/JRASERVER-70564
CVE: CVE-2019-20403
Published: 2020-02-06
Description: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70565; https://jira.atlassian.com/browse/JRASERVER-70565
CVE: CVE-2019-20404
Published: 2020-02-06
Description: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70569; https://jira.atlassian.com/browse/JRASERVER-70569
CVE: CVE-2019-20405
Published: 2020-02-06
Description: The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-70570; https://jira.atlassian.com/browse/JRASERVER-70570
CVE: CVE-2019-20406
Published: 2020-02-06
Description: The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jira.atlassian.com/browse/CONFSERVER-59428; https://jira.atlassian.com/browse/CONFSERVER-59428
CVE: CVE-2020-8658
Published: 2020-02-06
Description: The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/V1n1v131r4/Exploiting-WP-Htaccess-by-BestWebSoft-Plugin/blob/master/README.md; https://wordpress.org/plugins/htaccess/#developers; https://wpvulndb.com/vulnerabilities/10060
CVE: CVE-2020-5528
Published: 2020-02-06
Description: Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced 1.26 and earlier (Movable Type Premium Advanced)) allows remote attackers to inject arbitrary web script or HTML in the block editor and the rich text editor via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN94435544/index.html; https://movabletype.org/news/2020/02/movable_type_r4605_v720_v653_and_v6311_released.html; http://jvn.jp/en/jp/JVN94435544/index.html
CVE: CVE-2010-3917
Published: 2020-02-06
Description: Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN36765384/index.html; http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000056.html; http://jvn.jp/en/jp/JVN36765384/index.html
CVE: CVE-2012-2593
Published: 2020-02-06
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20009; http://www.securityfocus.com/bid/54630; http://www.exploit-db.com/exploits/20009
CVE: CVE-2015-6000
Published: 2020-02-06
Description: Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html; http://www.securityfocus.com//archive/1/536563/100/0/threaded; https://www.exploit-db.com/exploits/38345/
CVE: CVE-2016-7523
Published: 2020-02-06
Description: coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/09/22/2; https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537420; https://bugzilla.redhat.com/show_bug.cgi?id=1378754
CVE: CVE-2016-7524
Published: 2020-02-06
Description: coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/09/22/2; https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537422; https://bugzilla.redhat.com/show_bug.cgi?id=1378762
CVE: CVE-2016-9928
Published: 2020-02-06
Description: MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.
CVSS Score: 7.4 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-updates/2017-01/msg00130.html; http://www.openwall.com/lists/oss-security/2016/12/11/2; http://www.openwall.com/lists/oss-security/2017/02/09/29
CVE: CVE-2013-4166
Published: 2020-02-06
Description: The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2013-1540.html; http://seclists.org/oss-sec/2013/q3/191; https://bugzilla.redhat.com/show_bug.cgi?id=973728
CVE: CVE-2013-4572
Published: 2020-02-06
Description: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE: CVE-2014-1958
Published: 2020-02-06
Description: Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html; http://trac.imagemagick.org/changeset/14801
CVE: CVE-2014-2030
Published: 2020-02-06
Description: Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html; http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html; http://ubuntu.com/usn/usn-2132-1
CVE: CVE-2014-8271
Published: 2020-02-06
Description: Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: http://sourceforge.net/p/edk2/code/16280/; http://www.kb.cert.org/vuls/id/533140; http://sourceforge.net/p/edk2/code/16280/
CVE: CVE-2015-2909
Published: 2020-02-06
Description: Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/; http://www.kb.cert.org/vuls/id/276148; http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/
CVE: CVE-2016-1544
Published: 2020-02-06
Description: nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
CVSS Score: 3.3 (LOW)
CWE: CWE-400
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177308.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177666.html; https://bugzilla.redhat.com/show_bug.cgi?id=1308461
CVE: CVE-2013-4521
Published: 2020-02-06
Description: RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://doc.nuxeo.com/display/public/ADMINDOC58/Nuxeo+Security+Hotfixes; https://bugzilla.redhat.com/show_bug.cgi?id=1027052; https://github.com/nuxeo/richfaces/commit/6cbad2a6dcb70d3e33a6ce5879b1a3ad79eb1aec
CVE: CVE-2014-10399
Published: 2020-02-06
Description: The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-384
References: http://seclists.org/fulldisclosure/2014/Apr/318; http://www.securityfocus.com/archive/1/531981/100/0/threaded; http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid
CVE: CVE-2014-10400
Published: 2020-02-06
Description: The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-384
References: http://seclists.org/fulldisclosure/2014/Apr/318; http://www.securityfocus.com/archive/1/531981/100/0/threaded; http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid
CVE: CVE-2014-2875
Published: 2020-02-06
Description: The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-307
References: http://seclists.org/fulldisclosure/2014/Apr/318; http://www.securityfocus.com/archive/1/531981/100/0/threaded; http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid