deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4162
Published: 2016-06-16
Description: Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, and CVE-2016-4163.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618; https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
CVE: CVE-2016-4163
Published: 2016-06-16
Description: Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, and CVE-2016-4162.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618; https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
CVE: CVE-2016-4164
Published: 2016-06-16
Description: Cross-site scripting (XSS) vulnerability in Adobe Brackets before 1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/brackets/apsb16-20.html; https://helpx.adobe.com/security/products/brackets/apsb16-20.html
CVE: CVE-2016-4165
Published: 2016-06-16
Description: The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/brackets/apsb16-20.html; https://helpx.adobe.com/security/products/brackets/apsb16-20.html
CVE: CVE-2016-4166
Published: 2016-06-16
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html
CVE: CVE-2016-4167
Published: 2016-06-16
Description: Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://helpx.adobe.com/security/products/dng-sdk/apsb16-19.html; https://helpx.adobe.com/security/products/dng-sdk/apsb16-19.html
CVE: CVE-2016-4171
Published: 2016-06-16
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html
CVE: CVE-2016-5361
Published: 2016-06-16
Description: programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2603.html; http://www.openwall.com/lists/oss-security/2016/06/10/4; https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6
CVE: CVE-2012-6702
Published: 2016-06-16
Description: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: http://www.debian.org/security/2016/dsa-3597; http://www.openwall.com/lists/oss-security/2016/06/03/8; http://www.openwall.com/lists/oss-security/2016/06/04/1
CVE: CVE-2016-2391
Published: 2016-06-16
Description: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360; http://www.openwall.com/lists/oss-security/2016/02/16/2; http://www.securityfocus.com/bid/83263
CVE: CVE-2016-2392
Published: 2016-06-16
Description: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
CVSS Score: 6.5 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=80eecda8e5d09c442c24307f340840a5b70ea3b9; http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html; http://www.openwall.com/lists/oss-security/2016/02/16/7
CVE: CVE-2016-2538
Published: 2016-06-16
Description: Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.
CVSS Score: 7.1 (HIGH)
CWE: CWE-189
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e; http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html; http://www.openwall.com/lists/oss-security/2016/02/22/3
CVE: CVE-2016-2841
Published: 2016-06-16
Description: The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190; http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html; http://www.openwall.com/lists/oss-security/2016/03/02/8
CVE: CVE-2016-3062
Published: 2016-06-16
Description: The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00105.html; http://www.debian.org/security/2016/dsa-3603; https://bugzilla.libav.org/show_bug.cgi?id=929
CVE: CVE-2016-3687
Published: 2016-06-16
Description: Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securitytracker.com/id/1036111; https://support.f5.com/kb/en-us/solutions/public/k/26/sol26738102.html; http://www.securitytracker.com/id/1036111
CVE: CVE-2016-5300
Published: 2016-06-16
Description: The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3597; http://www.openwall.com/lists/oss-security/2016/06/04/4; http://www.openwall.com/lists/oss-security/2016/06/04/5
CVE: CVE-2015-8914
Published: 2016-06-17
Description: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2016/06/10/5; http://www.openwall.com/lists/oss-security/2016/06/10/6; https://access.redhat.com/errata/RHSA-2016:1473
CVE: CVE-2016-3642
Published: 2016-06-17
Description: The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/137486/Solarwinds-Virtualization-Manager-6.3.1-Java-Deserialization.html; http://seclists.org/fulldisclosure/2016/Jun/25; http://seclists.org/fulldisclosure/2016/Jun/29
CVE: CVE-2016-3643
Published: 2016-06-17
Description: SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2016/Jun/26; https://www.exploit-db.com/exploits/39967/
CVE: CVE-2016-5362
Published: 2016-06-17
Description: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
CVSS Score: 8.2 (HIGH)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2016/06/10/5; http://www.openwall.com/lists/oss-security/2016/06/10/6; https://access.redhat.com/errata/RHSA-2016:1473
CVE: CVE-2016-5363
Published: 2016-06-17
Description: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
CVSS Score: 8.2 (HIGH)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2016/06/10/5; http://www.openwall.com/lists/oss-security/2016/06/10/6; https://access.redhat.com/errata/RHSA-2016:1473
CVE: CVE-2016-5433
Published: 2016-06-17
Description: Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-310
References: http://support.citrix.com/article/CTX213998; http://support.citrix.com/article/CTX213998
CVE: CVE-2016-1427
Published: 2016-06-18
Description: The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160616-pnr; http://www.securitytracker.com/id/1036128; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160616-pnr
CVE: CVE-2016-1431
Published: 2016-06-18
Description: Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur25516.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160617-fmc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160617-fmc
CVE: CVE-2016-1432
Published: 2016-06-18
Description: Cisco IOS XE 3.15S and 3.16S on cBR-8 Converged Broadband Router devices allows remote authenticated users to cause a denial of service (NULL pointer dereference and card restart) via a crafted SNMP request, aka Bug ID CSCuu68862.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160617-cbr; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160617-cbr
CVE: CVE-2016-1183
Published: 2016-06-19
Description: NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN74659077/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098; http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183
CVE: CVE-2016-1223
Published: 2016-06-19
Description: Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx; http://jvn.jp/en/jp/JVN48847535/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000074
CVE: CVE-2016-1224
Published: 2016-06-19
Description: CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx; http://jvn.jp/en/jp/JVN48847535/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000089
CVE: CVE-2016-1395
Published: 2016-06-19
Description: The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID CSCux82428.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv; http://www.securitytracker.com/id/1036113; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv
CVE: CVE-2016-1396
Published: 2016-06-19
Description: Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux82583.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv1; http://www.securitytracker.com/id/1036114; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv1
CVE: CVE-2016-1397
Published: 2016-06-19
Description: Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote authenticated users to cause a denial of service (device reload) via crafted configuration commands in an HTTP request, aka Bug ID CSCux82523.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv2; http://www.securitytracker.com/id/1036115; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv2
CVE: CVE-2016-1424
Published: 2016-06-19
Description: Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug ID CSCun63132.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160616-ios; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160616-ios
CVE: CVE-2016-4371
Published: 2016-06-19
Description: HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery (SSRF) attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and Service Request components.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05167176; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05167176
CVE: CVE-2016-4813
Published: 2016-06-19
Description: NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://jvn.jp/en/jp/JVN00460236/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000075; http://www.netcommons.org/muer4mz6s-6669
CVE: CVE-2016-4814
Published: 2016-06-19
Description: Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN13794955/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000090; http://www.gsi.go.jp/johofukyu/johofukyu40062.html
CVE: CVE-2016-4815
Published: 2016-06-19
Description: Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://buffalo.jp/support_s/s20160527b.html; http://jvn.jp/en/jp/JVN81698369/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000086
CVE: CVE-2016-4816
Published: 2016-06-19
Description: BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://buffalo.jp/support_s/s20160527a.html; http://jvn.jp/en/jp/JVN75813272/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000087
CVE: CVE-2016-4817
Published: 2016-06-19
Description: lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN87859762/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000091; https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4
CVE: CVE-2016-4819
Published: 2016-06-19
Description: The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Library for Visual C++ 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.
CVSS Score: 9.8 (CRITICAL)
References: http://dxlib.o.oo7.jp/dxvulnerability.html; http://jvn.jp/en/jp/JVN15205734/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000099
CVE: CVE-2016-4820
Published: 2016-06-19
Description: Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN61317238/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000100; http://www.iodata.jp/support/information/2016/etx-r/
CVE: CVE-2016-4821
Published: 2016-06-19
Description: I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN96052093/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000101; http://www.iodata.jp/support/information/2016/etx-r/
CVE: CVE-2015-7775
Published: 2016-06-19
Description: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49285177/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000084; https://support.cybozu.com/ja-jp/article/8893
CVE: CVE-2016-1195
Published: 2016-06-19
Description: Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
CVSS Score: 7.4 (HIGH)
References: http://jvn.jp/en/jp/JVN32218514/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000081; https://support.cybozu.com/ja-jp/article/8987
CVE: CVE-2016-1197
Published: 2016-06-19
Description: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN37121456/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000083; https://support.cybozu.com/ja-jp/article/9303
CVE: CVE-2016-1225
Published: 2016-06-19
Description: Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN48789425/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000073; http://www.securitytracker.com/id/1036137
CVE: CVE-2016-1226
Published: 2016-06-19
Description: Cross-site scripting (XSS) vulnerability in Trend Micro Internet Security 8 and 10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN48789425/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000088; http://www.securitytracker.com/id/1036137
CVE: CVE-2015-7462
Published: 2016-06-19
Description: IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to execute the mqcertck program.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984557; http://www.securitytracker.com/id/1036053; http://www-01.ibm.com/support/docview.wss?uid=swg21984557