deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3833
Published: 2015-10-01
Description: The getRunningAppProcesses function in services/core/java/com/android/server/am/ActivityManagerService.java in Android before 5.1.1 LMY48I allows attackers to bypass intended getRecentTasks restrictions and discover the name of the foreground application via a crafted application, aka internal bug 20034603.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://stackoverflow.com/questions/24625936/getrunningtasks-doesnt-work-in-android-l; https://android.googlesource.com/platform/frameworks/base/+/aaa0fee0d7a8da347a0c47cef5249c70efee209e; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ
CVE: CVE-2015-3834
Published: 2015-10-01
Description: Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption, leading to a heap-based buffer overflow, aka internal bug 20222489.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/frameworks/av/+/c82e31a7039a03dca7b37c65b7890ba5c1e18ced; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/av/+/c82e31a7039a03dca7b37c65b7890ba5c1e18ced
CVE: CVE-2015-3835
Published: 2015-10-01
Description: Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://android.googlesource.com/platform/frameworks/av/+/086d84f45ab7b64d1a7ed7ac8ba5833664a6a5ab; https://android.googlesource.com/platform/frameworks/av/+/3cb1b6944e776863aea316e25fdc16d7f9962902; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ
CVE: CVE-2015-3836
Published: 2015-10-01
Description: The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/external/sonivox/+/e999f077f6ef59d20282f1e04786816a31fb8be6; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/external/sonivox/+/e999f077f6ef59d20282f1e04786816a31fb8be6
CVE: CVE-2015-3837
Published: 2015-10-01
Description: The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/external/conscrypt/+/edf7055461e2d7fa18de5196dca80896a56e3540; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/external/conscrypt/+/edf7055461e2d7fa18de5196dca80896a56e3540
CVE: CVE-2015-3842
Published: 2015-10-01
Description: Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://android.googlesource.com/platform/frameworks/av/+/aeea52da00d210587fb3ed895de3d5f2e0264c88; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/av/+/aeea52da00d210587fb3ed895de3d5f2e0264c88
CVE: CVE-2015-3843
Published: 2015-10-01
Description: The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://android.googlesource.com/platform/frameworks/base/+/a5e904e7eb3aaec532de83ca52e24af18e0496b4; https://android.googlesource.com/platform/frameworks/opt/telephony/+/b[PII_REDACTED]9439dc5ef6dcf8b0f303e4cbefbe9; https://android.googlesource.com/platform/packages/apps/Stk/+/1d8e00160c07ae308e5b460214eb2a425b93ccf7
CVE: CVE-2015-3844
Published: 2015-10-01
Description: The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: https://android.googlesource.com/platform/frameworks/base/+/e3cde784e3d99966f313fe00dcecf191f6a44a31; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/base/+/e3cde784e3d99966f313fe00dcecf191f6a44a31
CVE: CVE-2015-3845
Published: 2015-10-01
Description: The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, aka internal bug 17312693.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: https://android.googlesource.com/platform/frameworks/native/+/e68cbc3e9e66df4231e70efa3e9c41abc12aea20; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ; https://android.googlesource.com/platform/frameworks/native/+/e68cbc3e9e66df4231e70efa3e9c41abc12aea20
CVE: CVE-2015-3849
Published: 2015-10-01
Description: The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://android.googlesource.com/platform/frameworks/base/+/1e72dc7a3074cd0b44d89afbf39bbf5000ef7cc3; https://android.googlesource.com/platform/frameworks/base/+/4cff1f49ff95d990d6c2614da5d5a23d02145885; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ
CVE: CVE-2015-3858
Published: 2015-10-01
Description: The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://android.googlesource.com/platform/frameworks/opt/telephony/+/df31d37d285dde9911b699837c351aed2320b586; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ; https://android.googlesource.com/platform/frameworks/opt/telephony/+/df31d37d285dde9911b699837c351aed2320b586
CVE: CVE-2015-3860
Published: 2015-10-01
Description: packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/; https://android.googlesource.com/platform/frameworks/base/+/8fba7e6931245a17215e0e740e78b45f6b66d590; https://code.google.com/p/android/issues/detail?id=178139
CVE: CVE-2015-3861
Published: 2015-10-01
Description: Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug 21296336.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: https://android.googlesource.com/platform/frameworks/av/+/304ef91624e12661e7e35c2c0c235da84a73e9c0; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ; https://android.googlesource.com/platform/frameworks/av/+/304ef91624e12661e7e35c2c0c235da84a73e9c0
CVE: CVE-2015-3863
Published: 2015-10-01
Description: Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/system/security/+/bb9f4392c2f1b11be3acdc[PII_REDACTED]ff1ec55b; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ; https://android.googlesource.com/platform/system/security/+/bb9f4392c2f1b11be3acdc[PII_REDACTED]ff1ec55b
CVE: CVE-2015-3864
Published: 2015-10-01
Description: Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/76682; https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968; https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/
CVE: CVE-2015-6575
Published: 2015-10-01
Description: SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915, CVE-2014-7916, and/or CVE-2014-7917.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/frameworks/av/+/cf1581c66c2ad8c5b1aaca2e43e350cf5974f46d; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/av/+/cf1581c66c2ad8c5b1aaca2e43e350cf5974f46d
CVE: CVE-2015-1335
Published: 2015-10-01
Description: lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170045.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171358.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171364.html
CVE: CVE-2015-1338
Published: 2015-10-01
Description: kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html; http://seclists.org/fulldisclosure/2015/Sep/101; http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/
CVE: CVE-2015-7236
Published: 2015-10-01
Description: Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171030.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172152.html; http://www.debian.org/security/2015/dsa-3366
CVE: CVE-2015-7311
Published: 2015-10-01
Description: libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.
CVSS Score: 3.6 (LOW)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167077.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.html
CVE: CVE-2015-7612
Published: 2015-10-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securitytracker.com/id/1033682; https://kc.mcafee.com/corporate/index?page=content&id=SB10135; http://www.securitytracker.com/id/1033682
CVE: CVE-2015-2858
Published: 2015-10-02
Description: Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/693036; http://www.kb.cert.org/vuls/id/693036
CVE: CVE-2015-3876
Published: 2015-10-02
Description: libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://twitter.com/4Dgifts/statuses/[PII_REDACTED]92339968; http://www.securitytracker.com/id/1033725; https://code.google.com/p/android/issues/detail?id=182386
CVE: CVE-2015-4546
Published: 2015-10-02
Description: Directory traversal vulnerability in EMC RSA OneStep 6.9 before build 559, as used in RSA Certificate Manager and RSA Registration Manager through 6.9 build 558 and other products, allows remote attackers to read arbitrary files via a crafted KCSOSC_ERROR_PAGE parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133784/RSA-OneStep-6.9-Path-Traversal.html; http://seclists.org/bugtraq/2015/Sep/135; http://www.securitytracker.com/id/1033671
CVE: CVE-2015-6602
Published: 2015-10-02
Description: libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1033725; https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/; https://support.silentcircle.com/customer/en/portal/articles/2145864-privatos-1-1-12-release-notes
CVE: CVE-2015-5653
Published: 2015-10-02
Description: Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN07676450/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000140; http://jvn.jp/en/jp/JVN07676450/index.html
CVE: CVE-2015-6308
Published: 2015-10-02
Description: Cisco NX-OS 6.0(2)U6(0.46) on N3K devices allows remote authenticated users to cause a denial of service (temporary SNMP outage) via an SNMP request for an OID that does not exist, aka Bug ID CSCuw36684.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41240; http://www.securitytracker.com/id/1033717; http://tools.cisco.com/security/center/viewAlert.x?alertId=41240
CVE: CVE-2015-6309
Published: 2015-10-02
Description: Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41241; http://www.securitytracker.com/id/1033716; http://tools.cisco.com/security/center/viewAlert.x?alertId=41241
CVE: CVE-2014-8916
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0144.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0141
Published: 2015-10-03
Description: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0142
Published: 2015-10-03
Description: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0143
Published: 2015-10-03
Description: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0144
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8916.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0145
Published: 2015-10-03
Description: Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21963358; http://www-01.ibm.com/support/docview.wss?uid=swg21963358
CVE: CVE-2015-0195
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21958969; http://www-01.ibm.com/support/docview.wss?uid=swg21958969
CVE: CVE-2015-1888
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21700205; http://www-01.ibm.com/support/docview.wss?uid=swg21700205
CVE: CVE-2015-4955
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 before 8.5.6.0 CF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR52696; http://www-01.ibm.com/support/docview.wss?uid=swg1JR53179; http://www-01.ibm.com/support/docview.wss?uid=swg1JR54007
CVE: CVE-2015-5651
Published: 2015-10-03
Description: Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dotclear.org/blog/post/2015/09/23/Dotclear-2.8.1; http://jvn.jp/en/jp/JVN65668004/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000148
CVE: CVE-2015-1933
Published: 2015-10-04
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965080; http://www-01.ibm.com/support/docview.wss?uid=swg21965080
CVE: CVE-2015-1934
Published: 2015-10-04
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly encrypt passwords, which makes it easier for context-dependent attackers to determine cleartext passwords by leveraging access to a password file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21964855; http://www-01.ibm.com/support/docview.wss?uid=swg21964855
CVE: CVE-2015-1969
Published: 2015-10-04
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Common Reporting (TCR) 2.1 before IF13 and 2.1.1 before IF21, and TCR 3.1.x as used in Cognos Business Intelligence before 10.2 IF0015 and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967384; http://www.securityfocus.com/bid/76472; http://www.securitytracker.com/id/1034050