deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6858
Published: 2016-01-05
Description: HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/79343; http://www.securitytracker.com/id/1034310; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918653
CVE: CVE-2015-6859
Published: 2016-01-05
Description: HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2015-6860.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034410; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04920918; http://www.securitytracker.com/id/1034410
CVE: CVE-2015-6860
Published: 2016-01-05
Description: HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2015-6859.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034410; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04920918; http://www.securitytracker.com/id/1034410
CVE: CVE-2015-6861
Published: 2016-01-05
Description: HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/79650; https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926482; http://www.securityfocus.com/bid/79650
CVE: CVE-2015-5310
Published: 2016-01-06
Description: The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-01-01.html; http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt; http://www.debian.org/security/2015/dsa-3397
CVE: CVE-2015-6636
Published: 2016-01-06
Description: mediaserver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 25070493 and 24686670.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6637
Published: 2016-01-06
Description: The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 25307013.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6638
Published: 2016-01-06
Description: The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6639
Published: 2016-01-06
Description: The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24446875.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/172637/Widevine-Trustlet-5.x-6.x-7.x-PRDiagVerifyProvisioning-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/May/26; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6640
Published: 2016-01-06
Description: The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; https://android.googlesource.com/kernel%2Fcommon/+/69bfe2d957d903521d32324190c2754cb073be15
CVE: CVE-2015-6641
Published: 2016-01-06
Description: Bluetooth in Android 6.0 before 2016-01-01 allows remote attackers to obtain sensitive Contacts information by leveraging pairing, aka internal bug 23607427.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6642
Published: 2016-01-06
Description: The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24157888.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6643
Published: 2016-01-06
Description: Setup Wizard in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows physically proximate attackers to modify settings or bypass a reset protection mechanism via unspecified vectors, aka internal bug 25290269.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6644
Published: 2016-01-06
Description: Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.debian.org/security/2017/dsa-3829; http://www.securityfocus.com/bid/79865
CVE: CVE-2015-6645
Published: 2016-01-06
Description: SyncManager in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to cause a denial of service (continuous rebooting) via a crafted application, aka internal bug 23591205.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6646
Published: 2016-01-06
Description: The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumption) by leveraging improper interaction between IPC resource allocation and the memory manager, aka internal bug 22300191, a different vulnerability than CVE-2015-7613.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-399
References: http://source.android.com/security/bulletin/2016-01-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6647
Published: 2016-01-06
Description: The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/172637/Widevine-Trustlet-5.x-6.x-7.x-PRDiagVerifyProvisioning-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2023/May/26; http://source.android.com/security/bulletin/2016-01-01.html
CVE: CVE-2015-6433
Published: 2016-01-08
Description: SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160105-cucm; http://www.securitytracker.com/id/1034583; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160105-cucm
CVE: CVE-2015-6434
Published: 2016-01-08
Description: Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCux64856.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160105-pi; http://www.securitytracker.com/id/1034582; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160105-pi
CVE: CVE-2015-6862
Published: 2016-01-08
Description: HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors.
CVSS Score: 8.4 (HIGH)
CWE: CWE-200, CWE-284
References: http://www.securitytracker.com/id/1034596; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04924053; http://www.securitytracker.com/id/1034596
CVE: CVE-2015-8261
Published: 2016-01-08
Description: The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securitytracker.com/id/1034613; https://www.exploit-db.com/exploits/39231/; https://www.kb.cert.org/vuls/id/753264
CVE: CVE-2016-1131
Published: 2016-01-08
Description: Buffer overflow in the CL_vsprintf function in Takumi Yamada DX Library before 3.16 allows remote attackers to execute arbitrary code via a crafted string.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://homepage2.nifty.com/natupaji/DxLib/dxvulnerability.html; http://jvn.jp/en/jp/JVN49476817/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000001
CVE: CVE-2015-5254
Published: 2016-01-08
Description: Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.html
CVE: CVE-2015-5259
Published: 2016-01-08
Description: Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-189
References: http://subversion.apache.org/security/CVE-2015-5259-advisory.txt; http://www.securityfocus.com/bid/82300; http://www.securitytracker.com/id/1034469
CVE: CVE-2015-6856
Published: 2016-01-08
Description: Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x0022201c IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/134987/Dell-Authentication-Driver-Uncontrolled-Write.html; http://seclists.org/fulldisclosure/2015/Dec/81; http://www.securityfocus.com/archive/1/537161/100/0/threaded
CVE: CVE-2015-7328
Published: 2016-01-08
Description: Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://puppetlabs.com/security/cve/cve-2015-7328; https://puppetlabs.com/security/cve/cve-2015-7328
CVE: CVE-2015-7362
Published: 2016-01-08
Description: Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability; http://www.fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability; http://fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability
CVE: CVE-2015-7519
Published: 2016-01-08
Description: agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00024.html; http://www.openwall.com/lists/oss-security/2015/12/07/1; http://www.openwall.com/lists/oss-security/2015/12/07/2
CVE: CVE-2015-7554
Published: 2016-01-08
Description: The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-updates/2016-01/msg00078.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00081.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00100.html
CVE: CVE-2015-7754
Published: 2016-01-08
Description: Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10712; http://www.securityfocus.com/bid/79627; http://www.securitytracker.com/id/1034490
CVE: CVE-2015-7758
Published: 2016-01-08
Description: Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178582.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178642.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00117.html
CVE: CVE-2015-8225
Published: 2016-01-08
Description: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm
CVE: CVE-2015-8226
Published: 2016-01-08
Description: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm
CVE: CVE-2015-8303
Published: 2016-01-08
Description: Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local users to obtain sensitive information by pasting the contents to another file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462410.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462410.htm
CVE: CVE-2015-8481
Published: 2016-01-08
Description: Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup referencing an image attachment, which might allow remote attackers to obtain sensitive information by updating a different issue that includes wiki markup for an external image reference.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/79381; https://confluence.atlassian.com/jira/jira-security-advisory-2015-12-09-792307790.html; https://jira.atlassian.com/browse/JRA-47557
CVE: CVE-2015-8547
Published: 2016-01-08
Description: The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174938.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174976.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00099.html
CVE: CVE-2015-8597
Published: 2016-01-08
Description: Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
CVSS Score: 7.4 (HIGH)
References: http://knowitsecure.se/2015/12/18/knowit-secure-sakrar-bluecoat/; http://www.securitytracker.com/id/1034506; https://bto.bluecoat.com/security-advisory/sa107
CVE: CVE-2015-8612
Published: 2016-01-08
Description: The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/135047/Slackware-Security-Advisory-blueman-Updates.html; http://www.debian.org/security/2015/dsa-3427; http://www.openwall.com/lists/oss-security/2015/12/18/6
CVE: CVE-2015-8615
Published: 2016-01-08
Description: The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/79644; http://www.securitytracker.com/id/1034512; http://xenbits.xen.org/xsa/advisory-169.html
CVE: CVE-2015-8668
Published: 2016-01-08
Description: Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/135080/libtiff-4.0.6-Heap-Overflow.html; http://rhn.redhat.com/errata/RHSA-2016-1546.html; http://rhn.redhat.com/errata/RHSA-2016-1547.html
CVE: CVE-2015-8753
Published: 2016-01-08
Description: SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-264
References: https://erpscan.io/advisories/erpscan-15-023-sap-afaria-authorization-bypass-insecure-signature/; https://erpscan.io/advisories/erpscan-15-023-sap-afaria-authorization-bypass-insecure-signature/
CVE: CVE-2015-8754
Published: 2016-01-08
Description: The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.drupal.org/node/2626872; https://www.drupal.org/node/2627448; https://www.drupal.org/node/2626872
CVE: CVE-2015-8755
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/; http://www.securityfocus.com/bid/79236; http://www.securitytracker.com/id/1034483
CVE: CVE-2015-8756
Published: 2016-01-08
Description: Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/; http://www.securitytracker.com/id/1034486; http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/
CVE: CVE-2015-8757
Published: 2016-01-08
Description: Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension installation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/; http://www.securityfocus.com/bid/79254; http://www.securitytracker.com/id/1034482
CVE: CVE-2015-8758
Published: 2016-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/; http://www.securityfocus.com/bid/79240; http://www.securitytracker.com/id/1034484