deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2526
Published: 2015-09-09
Description: Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://www.securityfocus.com/bid/76567; http://www.securitytracker.com/id/1033493; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101
CVE: CVE-2015-2527
Published: 2015-09-09
Description: The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/76599; http://www.securitytracker.com/id/1033485; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-097
CVE: CVE-2015-2528
Published: 2015-09-09
Description: Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2524.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/159109/Microsoft-Windows-CloudExperienceHostBroker-Privilege-Escalation.html; http://www.securitytracker.com/id/1033494; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-102
CVE: CVE-2015-2529
Published: 2015-09-09
Description: The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."
CVSS Score: 2.1 (LOW)
CWE: CWE-254
References: http://www.securityfocus.com/bid/76602; http://www.securitytracker.com/id/1033485; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-097
CVE: CVE-2015-2530
Published: 2015-09-09
Description: Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2514.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1033484; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-098; http://www.securitytracker.com/id/1033484
CVE: CVE-2015-2531
Published: 2015-09-09
Description: Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033497; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-104; http://www.securitytracker.com/id/1033497
CVE: CVE-2015-2532
Published: 2015-09-09
Description: Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033497; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-104; http://www.securitytracker.com/id/1033497
CVE: CVE-2015-2534
Published: 2015-09-09
Description: Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability."
CVSS Score: 1.9 (LOW)
CWE: CWE-284
References: http://www.securitytracker.com/id/1033496; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-105; http://www.securitytracker.com/id/1033496
CVE: CVE-2015-2535
Published: 2015-09-09
Description: Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts, aka "Active Directory Denial of Service Vulnerability."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-17
References: http://www.securitytracker.com/id/1033492; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-096; http://www.securitytracker.com/id/1033492
CVE: CVE-2015-2536
Published: 2015-09-09
Description: Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033497; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-104; http://www.securitytracker.com/id/1033497
CVE: CVE-2015-2541
Published: 2015-09-09
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2491.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/76583; http://www.securitytracker.com/id/1033487; http://www.zerodayinitiative.com/advisories/ZDI-15-428
CVE: CVE-2015-2542
Published: 2015-09-09
Description: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/76571; http://www.securitytracker.com/id/1033487; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-094
CVE: CVE-2015-2543
Published: 2015-09-09
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033495; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-103; http://www.securitytracker.com/id/1033495
CVE: CVE-2015-2544
Published: 2015-09-09
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033495; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-103; http://www.securitytracker.com/id/1033495
CVE: CVE-2015-2545
Published: 2015-09-09
Description: Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://blog.morphisec.com/exploit-bypass-emet-cve-2015-2545; http://www.securitytracker.com/id/1033488; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099
CVE: CVE-2015-2546
Published: 2015-09-09
Description: The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/76608; http://www.securitytracker.com/id/1033485; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-097
CVE: CVE-2015-6680
Published: 2015-09-09
Description: Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6681.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1033486; https://helpx.adobe.com/security/products/shockwave/apsb15-22.html; https://security.gentoo.org/glsa/201509-07
CVE: CVE-2015-6681
Published: 2015-09-09
Description: Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6680.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033486; https://helpx.adobe.com/security/products/shockwave/apsb15-22.html; https://security.gentoo.org/glsa/201509-07
CVE: CVE-2015-5249
Published: 2015-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-6584
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133555/DataTables-1.10.8-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/37; http://www.securityfocus.com/archive/1/536437/100/0/threaded
CVE: CVE-2015-6827
Published: 2015-09-11
Description: Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentication of users for requests that change a password via a request to signup.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133498/Autoexchanger-5.1.0-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/38119/; http://packetstormsecurity.com/files/133498/Autoexchanger-5.1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2014-9208
Published: 2015-09-11
Description: Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01; https://www.exploit-db.com/exploits/38108/; https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01
CVE: CVE-2015-3964
Published: 2015-09-11
Description: SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/fulldisclosure/2015/Sep/51; https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02; http://seclists.org/fulldisclosure/2015/Sep/51
CVE: CVE-2015-5631
Published: 2015-09-11
Description: Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN07427376/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000129; http://www.canon.com/support/pdf/inkjet-printer.pdf
CVE: CVE-2015-6464
Published: 2015-09-11
Description: The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.
CVSS Score: 8.5 (HIGH)
References: http://www.moxa.com/support/download.aspx?type=support&id=328; https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03; http://www.moxa.com/support/download.aspx?type=support&id=328
CVE: CVE-2015-6465
Published: 2015-09-11
Description: The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service (reboot) via a crafted URL.
CVSS Score: 6.8 (MEDIUM)
References: http://www.moxa.com/support/download.aspx?type=support&id=328; http://www.securitytracker.com/id/1033543; https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03
CVE: CVE-2015-6466
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.moxa.com/support/download.aspx?type=support&id=328; https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03; http://www.moxa.com/support/download.aspx?type=support&id=328
CVE: CVE-2015-6675
Published: 2015-09-11
Description: Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1033478; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-720081.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-15-244-01
CVE: CVE-2015-6908
Published: 2015-09-11
Description: The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html
CVE: CVE-2015-6909
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/32; http://www.securityfocus.com/archive/1/536428/100/0/threaded
CVE: CVE-2015-6910
Published: 2015-09-11
Description: SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133519/Synology-Video-Station-1.5-0757-Command-Injection-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Sep/31; http://www.securityfocus.com/archive/1/536427/100/0/threaded
CVE: CVE-2015-6911
Published: 2015-09-11
Description: SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133519/Synology-Video-Station-1.5-0757-Command-Injection-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Sep/31; http://www.securityfocus.com/archive/1/536427/100/0/threaded
CVE: CVE-2015-6912
Published: 2015-09-11
Description: Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/133519/Synology-Video-Station-1.5-0757-Command-Injection-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Sep/31; http://www.securityfocus.com/archive/1/536427/100/0/threaded
CVE: CVE-2015-6913
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/32; http://www.securityfocus.com/archive/1/536428/100/0/threaded
CVE: CVE-2015-6914
Published: 2015-09-11
Description: Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133251/SiteFactory-CMS-5.5.9-Directory-Traversal.html; http://packetstormsecurity.com/files/133251/SiteFactory-CMS-5.5.9-Directory-Traversal.html
CVE: CVE-2015-6915
Published: 2015-09-11
Description: SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133297/ResourceSpace-CMS-7.3.7009-SQL-Injection.html; http://packetstormsecurity.com/files/133297/ResourceSpace-CMS-7.3.7009-SQL-Injection.html
CVE: CVE-2014-7216
Published: 2015-09-11
Description: Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133443/Yahoo-Messenger-11.5.0.228-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2015/Sep/24; http://www.securityfocus.com/archive/1/536390/100/0/threaded
CVE: CVE-2015-6919
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the googleSearch (CSE) (com_googlesearch_cse) component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133375/Joomla-GoogleSearch-CSE-3.0.2-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/133375/Joomla-GoogleSearch-CSE-3.0.2-Cross-Site-Scripting.html
CVE: CVE-2015-6920
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133371/WordPress-sourceAFRICA-0.1.3-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/8169; http://packetstormsecurity.com/files/133371/WordPress-sourceAFRICA-0.1.3-Cross-Site-Scripting.html
CVE: CVE-2015-6921
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://www.drupal.org/node/2561887; https://www.drupal.org/node/2561893; https://www.drupal.org/node/2561887
CVE: CVE-2015-5629
Published: 2015-09-11
Description: The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN04644117/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000115; https://itunes.apple.com/en/app/japan-connected-free-wi-fi/id810838196?mt=8
CVE: CVE-2015-5630
Published: 2015-09-11
Description: Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN41048401/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000116; https://itunes.apple.com/en/app/japan-connected-free-wi-fi/id810838196?mt=8
CVE: CVE-2015-5226
Published: 2015-09-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5270
Published: 2015-09-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-2013
Published: 2015-09-14
Description: IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV73860; http://www-01.ibm.com/support/docview.wss?uid=swg21962479; http://www.securitytracker.com/id/1033449
CVE: CVE-2015-4499
Published: 2015-09-14
Description: Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168725.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169946.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169983.html
CVE: CVE-2015-6285
Published: 2015-09-14
Description: Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug21497.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-134
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40844; http://www.securitytracker.com/id/1033531; http://tools.cisco.com/security/center/viewAlert.x?alertId=40844
CVE: CVE-2015-6286
Published: 2015-09-14
Description: Cisco Application Visibility and Control (AVC) 15.3(3)JA, when FlexConnect is enabled, allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP packet, aka Bug ID CSCuu47016.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=40845; http://tools.cisco.com/security/center/viewAlert.x?alertId=40845