deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4586
Published: 2015-06-23
Description: Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/132324/CellPipe-7130-Cross-Site-Request-Forgery.html; http://www.securityfocus.com/bid/75384; http://packetstormsecurity.com/files/132324/CellPipe-7130-Cross-Site-Request-Forgery.html
CVE: CVE-2015-4725
Published: 2015-06-23
Description: Cross-site scripting (XSS) vulnerability in forgot.php in AudioShare 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132337/Audio-Share-2.0.2-Cross-Site-Scripting-Remote-File-Inclusion.html; http://www.securityfocus.com/bid/75383; http://packetstormsecurity.com/files/132337/Audio-Share-2.0.2-Cross-Site-Scripting-Remote-File-Inclusion.html
CVE: CVE-2015-4726
Published: 2015-06-23
Description: PHP remote file inclusion vulnerability in ajax/myajaxphp.php in AudioShare 2.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the config['basedir'] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/132337/Audio-Share-2.0.2-Cross-Site-Scripting-Remote-File-Inclusion.html; http://www.securityfocus.com/bid/75382; http://packetstormsecurity.com/files/132337/Audio-Share-2.0.2-Cross-Site-Scripting-Remote-File-Inclusion.html
CVE: CVE-2014-4882
Published: 2015-06-23
Description: Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/595884; http://www.kb.cert.org/vuls/id/595884
CVE: CVE-2015-0972
Published: 2015-06-23
Description: Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/626420; http://www.kb.cert.org/vuls/id/626420
CVE: CVE-2015-2860
Published: 2015-06-23
Description: Directory traversal vulnerability in Avigilon Control Center (ACC) 4 before 4.12.0.54 and 5 before 5.4.2.22 allows remote attackers to read arbitrary files via a crafted help/ URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/555984; http://www.securityfocus.com/bid/75115; http://www.kb.cert.org/vuls/id/555984
CVE: CVE-2015-2859
Published: 2015-06-23
Description: Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/264092; http://www.securityfocus.com/bid/75020; http://www.securitytracker.com/id/1032571
CVE: CVE-2015-3113
Published: 2015-06-23
Description: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-122
References: http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html
CVE: CVE-2014-4875
Published: 2015-06-24
Description: CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-255
References: http://www.kb.cert.org/vuls/id/301788; http://www.kb.cert.org/vuls/id/JLAD-9X4SPN; http://www.kb.cert.org/vuls/id/301788
CVE: CVE-2015-2308
Published: 2015-06-24
Description: Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN19578958/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089; http://www.securityfocus.com/bid/75357
CVE: CVE-2015-3109
Published: 2015-06-24
Description: Adobe Photoshop CC before 16.0 (aka 2015.0.0) allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/75242; http://www.securitytracker.com/id/1032659; https://helpx.adobe.com/security/products/photoshop/apsb15-12.html
CVE: CVE-2015-3110
Published: 2015-06-24
Description: Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/75243; http://www.securitytracker.com/id/1032658; http://www.securitytracker.com/id/1032659
CVE: CVE-2015-3111
Published: 2015-06-24
Description: Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/75240; http://www.securitytracker.com/id/1032658; http://www.securitytracker.com/id/1032659
CVE: CVE-2015-3112
Published: 2015-06-24
Description: Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/75245; http://www.securitytracker.com/id/1032658; http://www.securitytracker.com/id/1032659
CVE: CVE-2015-4208
Published: 2015-06-24
Description: Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39458; http://www.securityfocus.com/bid/75361; http://www.securitytracker.com/id/1032705
CVE: CVE-2015-4211
Published: 2015-06-24
Description: Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39466; http://www.securityfocus.com/bid/75373; http://www.securitytracker.com/id/1032704
CVE: CVE-2015-4212
Published: 2015-06-24
Description: Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering credentials, aka Bug ID CSCut17466.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39467; http://www.securityfocus.com/bid/75381; http://www.securitytracker.com/id/1032705
CVE: CVE-2015-4213
Published: 2015-06-24
Description: Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39469; http://www.securityfocus.com/bid/75378; http://www.securitytracker.com/id/1032712
CVE: CVE-2015-4214
Published: 2015-06-24
Description: Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39470; http://www.securityfocus.com/bid/75380; http://www.securitytracker.com/id/1032703
CVE: CVE-2015-4215
Published: 2015-06-24
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (device crash) by triggering an exception during attempted forwarding of unspecified IPv6 packets to a non-IPv6 device, aka Bug ID CSCuj01046.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39472; http://www.securityfocus.com/bid/75369; http://www.securitytracker.com/id/1032697
CVE: CVE-2015-4218
Published: 2015-06-24
Description: The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET request, aka Bug IDs CSCuu65622 and CSCuu70858.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39494; http://www.securityfocus.com/bid/75377; http://www.securitytracker.com/id/1032711
CVE: CVE-2015-4219
Published: 2015-06-24
Description: Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39501; http://www.securityfocus.com/bid/75379; http://www.securitytracker.com/id/1032713
CVE: CVE-2015-2169
Published: 2015-06-24
Description: Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132433/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jun/74; http://techtootech.blogspot.in/2015/06/found-xss-vulnerability-in-manage.html
CVE: CVE-2015-3900
Published: 2015-06-24
Description: RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
CVE: CVE-2015-4413
Published: 2015-06-24
Description: Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132425/WordPress-Nextend-Facebook-Connect-1.5.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jun/70; http://www.securityfocus.com/bid/75391
CVE: CVE-2015-5061
Published: 2015-06-24
Description: Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/75411; http://www.vulnerability-lab.com/get_content.php?id=1488; https://packetstormsecurity.com/files/132402/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html
CVE: CVE-2015-5062
Published: 2015-06-24
Description: Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.
CVSS Score: 5.8 (MEDIUM)
References: http://hyp3rlinx.altervista.org/advisories/AS-SILVERSTRIPE0607.txt; http://packetstormsecurity.com/files/132223/SilverStripe-CMS-3.1.13-XSS-Open-Redirect.html; http://www.securityfocus.com/archive/1/535716/100/0/threaded
CVE: CVE-2015-5063
Published: 2015-06-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter to install.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-SILVERSTRIPE0607.txt; http://packetstormsecurity.com/files/132223/SilverStripe-CMS-3.1.13-XSS-Open-Redirect.html; http://www.securityfocus.com/archive/1/535716/100/0/threaded
CVE: CVE-2015-5064
Published: 2015-06-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in MySql Lite Administrator (mysql-lite-administrator) beta-1 allow remote attackers to inject arbitrary web script or HTML via the table_name parameter to (1) tabella.php, (2) coloni.php, or (3) insert.php or (4) num_row parameter to coloni.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-MYSQLLITEADMINISTRATOR0621.txt; http://packetstormsecurity.com/files/132420/MySQL-Lite-Administrator-Beta-1-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535809/100/0/threaded
CVE: CVE-2015-5065
Published: 2015-06-24
Description: Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html; http://www.securityfocus.com/bid/75416; https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce
CVE: CVE-2015-5066
Published: 2015-06-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/AS-GENIXCMS0621.txt; http://packetstormsecurity.com/files/132397/GeniXCMS-0.0.3-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/535806/100/0/threaded
CVE: CVE-2015-5067
Published: 2015-06-24
Description: The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/133515/SAP-NetWeaver-AS-FKCDBFTRACE-ABAP-Hardcoded-Credentials.html; http://packetstormsecurity.com/files/133516/SAP-NetWeaver-AS-LSCT1I13-ABAP-Hardcoded-Credentials.html; http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015
CVE: CVE-2015-5068
Published: 2015-06-24
Description: XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/133514/SAP-Mobile-Platform-3-XXE-Injection.html; http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015; http://seclists.org/fulldisclosure/2015/Sep/36
CVE: CVE-2013-7397
Published: 2015-06-24
Description: Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: http://openwall.com/lists/oss-security/2014/08/26/1; http://rhn.redhat.com/errata/RHSA-2015-0850.html; http://rhn.redhat.com/errata/RHSA-2015-0851.html
CVE: CVE-2013-7398
Published: 2015-06-24
Description: main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: http://openwall.com/lists/oss-security/2014/08/26/1; http://rhn.redhat.com/errata/RHSA-2015-0850.html; http://rhn.redhat.com/errata/RHSA-2015-0851.html
CVE: CVE-2015-1851
Published: 2015-06-25
Description: OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html; http://rhn.redhat.com/errata/RHSA-2015-1206.html; http://www.debian.org/security/2015/dsa-3292
CVE: CVE-2015-4220
Published: 2015-06-25
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq03773.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39504; http://www.securityfocus.com/bid/75407; http://www.securitytracker.com/id/1032717
CVE: CVE-2015-4223
Published: 2015-06-25
Description: Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) packets, aka Bug ID CSCuu77478.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39509; http://www.securityfocus.com/bid/75399; http://www.securitytracker.com/id/1032715
CVE: CVE-2015-1158
Published: 2015-06-26
Description: The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
CVSS Score: 10.0 (HIGH)
CWE: CWE-254
References: http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
CVE: CVE-2015-1159
Published: 2015-06-26
Description: Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
CVE: CVE-2015-3242
Published: 2015-06-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-4216
Published: 2015-06-26
Description: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport; http://www.securityfocus.com/bid/75417; http://www.securitytracker.com/id/1032725
CVE: CVE-2015-4217
Published: 2015-06-26
Description: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport; http://tools.cisco.com/security/center/viewAlert.x?alertId=39461; http://www.securityfocus.com/bid/75418
CVE: CVE-2015-4221
Published: 2015-06-26
Description: Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a decryption attack, aka Bug ID CSCuq46194.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39505; http://www.securityfocus.com/bid/75401; http://www.securitytracker.com/id/1032716
CVE: CVE-2015-4222
Published: 2015-06-26
Description: SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39506; http://www.securityfocus.com/bid/75400; http://www.securitytracker.com/id/1032716
CVE: CVE-2015-4224
Published: 2015-06-26
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39517; http://www.securityfocus.com/bid/75415; http://www.securitytracker.com/id/1032728