deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3300
Published: 2015-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (34) post_type parameter in the admin/CustomFieldsList.php page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/121438; http://osvdb.org/show/osvdb/121469; http://osvdb.org/show/osvdb/121470
CVE: CVE-2015-3301
Published: 2015-05-14
Description: Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/show/osvdb/121439; http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html; http://www.securityfocus.com/archive/1/535396/100/0/threaded
CVE: CVE-2015-3427
Published: 2015-05-14
Description: Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.debian.org/security/2015/dsa-3258; http://www.quassel-irc.org/node/127; http://www.securityfocus.com/bid/74339
CVE: CVE-2015-3983
Published: 2015-05-14
Description: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.  NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html
CVE: CVE-2015-3986
Published: 2015-05-14
Description: Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html; http://www.securityfocus.com/archive/1/535396/100/0/threaded; http://www.securityfocus.com/bid/74395
CVE: CVE-2015-3987
Published: 2015-05-14
Description: Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/74685; http://www.securitytracker.com/id/1032244; https://kc.mcafee.com/corporate/index?page=content&id=SB10115
CVE: CVE-2015-0634
Published: 2015-05-15
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38811; http://www.securityfocus.com/bid/74647; http://www.securitytracker.com/id/1032329
CVE: CVE-2015-0724
Published: 2015-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38767; http://www.securitytracker.com/id/1032304; http://tools.cisco.com/security/center/viewAlert.x?alertId=38767
CVE: CVE-2015-0727
Published: 2015-05-15
Description: Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38788; http://www.securitytracker.com/id/1032326; http://tools.cisco.com/security/center/viewAlert.x?alertId=38788
CVE: CVE-2015-0728
Published: 2015-05-15
Description: Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38808; http://www.securitytracker.com/id/1032328; http://tools.cisco.com/security/center/viewAlert.x?alertId=38808
CVE: CVE-2015-0734
Published: 2015-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38866; http://www.securitytracker.com/id/1032333; http://tools.cisco.com/security/center/viewAlert.x?alertId=38866
CVE: CVE-2015-2250
Published: 2015-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to index.php/dashboard/reports/logs/view, (3) accessType parameter to index.php/tools/required/permissions/access_entity, (4) msCountry parameter to index.php/dashboard/system/multilingual/setup/load_icon, arHandle parameter to (5) design/submit or (6) design in index.php/ccm/system/dialogs/area/design/submit, (7) pageURL to index.php/dashboard/pages/single, (8) SEARCH_INDEX_AREA_METHOD parameter to index.php/dashboard/system/seo/searchindex/updated, (9) unit parameter to index.php/dashboard/system/optimization/jobs/job_scheduled, (10) register_notification_email parameter to index.php/dashboard/system/registration/open/1, or (11) PATH_INFO to index.php/dashboard/extend/connect/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/131882/Concrete5-5.7.3.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/May/51; http://www.securityfocus.com/archive/1/535531/100/0/threaded
CVE: CVE-2015-3325
Published: 2015-05-15
Description: SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/131801/WordPress-WP-Symposium-15.1-SQL-Injection.html; http://www.securityfocus.com/bid/74237; https://www.exploit-db.com/exploits/37080/
CVE: CVE-2015-3989
Published: 2015-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74699; https://www.concrete5.org/documentation/developers/5.7/background/version-history/5-7-4-release-notes/; http://www.securityfocus.com/bid/74699
CVE: CVE-2015-2810
Published: 2015-05-15
Description: Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor, as used in Hwp 2014 VP before 9.1.0.2342, HanWord Viewer 2007 and Viewer 2010 8.5.6.1158, and HwpViewer 2014 VP 9.1.0.2186, allows remote attackers to cause a denial of service (crash) and possibly "influence the program's execution flow" via a document with a large paragraph size, which triggers heap corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://seclists.org/bugtraq/2015/Apr/89; http://www.securityfocus.com/bid/74153; http://seclists.org/bugtraq/2015/Apr/89
CVE: CVE-2015-0731
Published: 2015-05-16
Description: The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38833; http://www.securitytracker.com/id/1032337; http://tools.cisco.com/security/center/viewAlert.x?alertId=38833
CVE: CVE-2015-0736
Published: 2015-05-16
Description: Cross-site request forgery (CSRF) vulnerability in Cisco MediaSense 10.5(1) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38869; http://www.securitytracker.com/id/1032336; http://tools.cisco.com/security/center/viewAlert.x?alertId=38869
CVE: CVE-2015-0717
Published: 2015-05-16
Description: Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20, CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38763; http://www.securitytracker.com/id/1032278; http://tools.cisco.com/security/center/viewAlert.x?alertId=38763
CVE: CVE-2015-0723
Published: 2015-05-16
Description: The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value, aka Bug ID CSCum03269.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38749; http://www.securitytracker.com/id/1032277; http://tools.cisco.com/security/center/viewAlert.x?alertId=38749
CVE: CVE-2015-0726
Published: 2015-05-16
Description: The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38789; http://www.securityfocus.com/bid/74641; http://www.securitytracker.com/id/1032327
CVE: CVE-2015-0729
Published: 2015-05-16
Description: Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38864; http://www.securitytracker.com/id/1032338; http://tools.cisco.com/security/center/viewAlert.x?alertId=38864
CVE: CVE-2015-0730
Published: 2015-05-16
Description: The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38865; http://www.securitytracker.com/id/1032339; http://tools.cisco.com/security/center/viewAlert.x?alertId=38865
CVE: CVE-2014-9204
Published: 2015-05-17
Description: Stack-based buffer overflow in OPCTest.exe in Rockwell Automation RSLinx Classic before 3.73.00 allows remote attackers to execute arbitrary code via a crafted CSV file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646324; https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02
CVE: CVE-2015-0735
Published: 2015-05-17
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38868; http://www.securitytracker.com/id/1032340; http://tools.cisco.com/security/center/viewAlert.x?alertId=38868
CVE: CVE-2015-0738
Published: 2015-05-17
Description: Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38884; http://www.securitytracker.com/id/1032349; http://tools.cisco.com/security/center/viewAlert.x?alertId=38884
CVE: CVE-2014-8383
Published: 2015-05-18
Description: The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html.
CVSS Score: 10.0 (HIGH)
References: http://packetstormsecurity.com/files/131661/InFocus-IN3128HD-Projector-Missing-Authentication.html; http://seclists.org/fulldisclosure/2015/Apr/88; http://www.coresecurity.com/advisories/infocus-in3128hd-projector-multiple-vulnerabilities
CVE: CVE-2014-8384
Published: 2015-05-18
Description: The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request.
CVSS Score: 9.4 (HIGH)
References: http://packetstormsecurity.com/files/131661/InFocus-IN3128HD-Projector-Missing-Authentication.html; http://seclists.org/fulldisclosure/2015/Apr/88; http://www.coresecurity.com/advisories/infocus-in3128hd-projector-multiple-vulnerabilities
CVE: CVE-2015-0278
Published: 2015-05-18
Description: libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-273
References: http://advisories.mageia.org/MGASA-2015-0186.html; http://www.mandriva.com/security/advisories?name=MDVSA-2015:228; https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c
CVE: CVE-2015-1868
Published: 2015-05-18
Description: The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.html
CVE: CVE-2015-2346
Published: 2015-05-18
Description: XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.
CVSS Score: 4.0 (MEDIUM)
References: http://packetstormsecurity.com/files/131459/Huawei-SEQ-Analyst-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Apr/42; http://packetstormsecurity.com/files/131459/Huawei-SEQ-Analyst-XXE-Injection.html
CVE: CVE-2015-2667
Published: 2015-05-18
Description: Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified directory.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/131731/GNS3-1.2.3-DLL-Hijacking.html; http://www.securityfocus.com/bid/74710; http://packetstormsecurity.com/files/131731/GNS3-1.2.3-DLL-Hijacking.html
CVE: CVE-2015-2704
Published: 2015-05-18
Description: realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155862.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157358.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html
CVE: CVE-2015-3306
Published: 2015-05-18
Description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVSS Score: 10.0 (HIGH)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
CVE: CVE-2015-3455
Published: 2015-05-18
Description: Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2015-0191.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00016.html
CVE: CVE-2015-3627
Published: 2015-05-18
Description: Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html; http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/28
CVE: CVE-2015-3629
Published: 2015-05-18
Description: Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html; http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/28
CVE: CVE-2015-3630
Published: 2015-05-18
Description: Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html; http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/28
CVE: CVE-2015-3631
Published: 2015-05-18
Description: Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html; http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html; http://seclists.org/fulldisclosure/2015/May/28
CVE: CVE-2015-0739
Published: 2015-05-19
Description: The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management Controller (BMC) file uploads via unspecified vectors, aka Bug ID CSCus87938.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=38905; http://www.securityfocus.com/bid/74709; http://www.securitytracker.com/id/1032359
CVE: CVE-2014-0194
Published: 2015-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2014-3685
Published: 2015-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-3168
Published: 2015-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-3164.  Reason: This candidate is a reservation duplicate of CVE-2015-3164.  Notes: All CVE users should reference CVE-2015-3164 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-8146
Published: 2015-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-8146.  Reason: This candidate is a duplicate of CVE-2014-8146.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-8146 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-8147
Published: 2015-05-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-8147.  Reason: This candidate is a duplicate of CVE-2014-8147.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-8147 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-0267
Published: 2015-05-19
Description: The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.6 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2015-0986.html; http://www.securityfocus.com/bid/74622; http://rhn.redhat.com/errata/RHSA-2015-0986.html