deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1944
Published: 2016-01-31
Description: The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-10.html
CVE: CVE-2016-1945
Published: 2016-01-31
Description: The nsZipArchive function in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect use of a pointer during processing of a ZIP archive.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-10.html
CVE: CVE-2016-1946
Published: 2016-01-31
Description: The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-10.html
CVE: CVE-2016-1947
Published: 2016-01-31
Description: Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for remote attackers to trigger an unintended download by leveraging the absence of reputation data.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html; http://www.mozilla.org/security/announce/2016/mfsa2016-11.html
CVE: CVE-2016-1948
Published: 2016-01-31
Description: Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to replace a theme's images and colors by modifying the client-server data stream.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-310
References: http://www.mozilla.org/security/announce/2016/mfsa2016-12.html; http://www.securitytracker.com/id/1034825; https://bugzilla.mozilla.org/show_bug.cgi?id=1235876
CVE: CVE-2016-1716
Published: 2016-02-01
Description: AppleGraphicsPowerManagement in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://www.securitytracker.com/id/1034736; https://support.apple.com/HT205731
CVE: CVE-2016-1717
Published: 2016-02-01
Description: The Disk Images component in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1718
Published: 2016-02-01
Description: The IOAcceleratorFamily2 interface in IOAcceleratorFamily in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://www.securitytracker.com/id/1034736; http://zerodayinitiative.com/advisories/ZDI-16-020/
CVE: CVE-2016-1719
Published: 2016-02-01
Description: The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1720
Published: 2016-02-01
Description: IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1721
Published: 2016-02-01
Description: The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1722
Published: 2016-02-01
Description: syslog in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1723
Published: 2016-02-01
Description: WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1725 and CVE-2016-1726.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
CVE: CVE-2016-1724
Published: 2016-02-01
Description: WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1727.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1725
Published: 2016-02-01
Description: WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1726.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
CVE: CVE-2016-1726
Published: 2016-02-01
Description: WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1725.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
CVE: CVE-2016-1727
Published: 2016-02-01
Description: WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1724.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
CVE: CVE-2016-1728
Published: 2016-02-01
Description: The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html; http://packetstormsecurity.com/files/136227/WebKitGTK-Memory-Corruption-Denial-Of-Service.html
CVE: CVE-2016-1729
Published: 2016-02-01
Description: Untrusted search path vulnerability in OSA Scripts in Apple OS X before 10.11.3 allows attackers to load arbitrary script libraries via a quarantined application.
CVSS Score: 7.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html; http://www.securitytracker.com/id/1034736; https://support.apple.com/HT205731
CVE: CVE-2016-1730
Published: 2016-02-01
Description: WebSheet in Apple iOS before 9.2.1 allows remote attackers to read or write to cookies by operating a crafted captive portal.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-19, CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html; http://www.securitytracker.com/id/1034737; https://support.apple.com/HT205732
CVE: CVE-2015-8265
Published: 2016-02-01
Description: Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow DNS query packets using the static source port, which makes it easier for remote attackers to spoof responses via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160129-01-dns-en; http://www.securityfocus.com/bid/82246; https://www.kb.cert.org/vuls/id/972224
CVE: CVE-2015-8781
Published: 2016-02-01
Description: tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2522#c0; http://lists.opensuse.org/opensuse-updates/2016-02/msg00058.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00064.html
CVE: CVE-2015-8782
Published: 2016-02-01
Description: tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2522; http://lists.opensuse.org/opensuse-updates/2016-02/msg00058.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00064.html
CVE: CVE-2015-8783
Published: 2016-02-01
Description: tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://bugzilla.maptools.org/show_bug.cgi?id=2522; http://lists.opensuse.org/opensuse-updates/2016-02/msg00058.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00064.html
CVE: CVE-2016-2049
Published: 2016-02-01
Description: examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/01/24/2; http://www.openwall.com/lists/oss-security/2016/01/24/5; http://www.openwall.com/lists/oss-security/2016/01/24/2
CVE: CVE-2016-2199
Published: 2016-02-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations and Remediation management page in Enterprise Manager in McAfee Vulnerability Manager (MVM) before 7.5.10 allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10147; https://kc.mcafee.com/corporate/index?page=content&id=SB10147
CVE: CVE-2016-7028
Published: 2016-02-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-0728.  Reason: This candidate is a duplicate of CVE-2016-0728.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2016-0728 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2213
Published: 2016-02-03
Description: The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=0aada30510d809bccfd539a90ea37b61188f2cb4; http://www.securitytracker.com/id/1034923; https://security.gentoo.org/glsa/201606-09
CVE: CVE-2015-5344
Published: 2016-02-03
Description: The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://camel.apache.org/security-advisories.data/CVE-2015-5344.txt.asc; http://rhn.redhat.com/errata/RHSA-2016-2035.html; http://www.securityfocus.com/archive/1/537414/100/0/threaded
CVE: CVE-2015-7536
Published: 2016-02-03
Description: Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
CVE: CVE-2015-7537
Published: 2016-02-03
Description: Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
CVE: CVE-2015-7538
Published: 2016-02-03
Description: Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
CVE: CVE-2015-7539
Published: 2016-02-03
Description: The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: http://rhn.redhat.com/errata/RHSA-2016-0489.html; https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
CVE: CVE-2015-7546
Published: 2016-02-03
Description: The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/80498; https://bugs.launchpad.net/keystone/+bug/1490804
CVE: CVE-2015-8747
Published: 2016-02-03
Description: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html; http://www.debian.org/security/2016/dsa-3462
CVE: CVE-2015-8748
Published: 2016-02-03
Description: Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html; http://www.debian.org/security/2016/dsa-3462
CVE: CVE-2016-1505
Published: 2016-02-03
Description: The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-21
References: http://www.openwall.com/lists/oss-security/2016/01/05/7; http://www.openwall.com/lists/oss-security/2016/01/06/4; http://www.openwall.com/lists/oss-security/2016/01/06/7
CVE: CVE-2016-1905
Published: 2016-02-03
Description: The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2016:0070; https://github.com/kubernetes/kubernetes/issues/19479; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2016-1906
Published: 2016-02-03
Description: Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://access.redhat.com/errata/RHSA-2016:0070; https://access.redhat.com/errata/RHSA-2016:0351; https://github.com/openshift/origin/issues/6556
CVE: CVE-2015-8269
Published: 2016-02-04
Description: The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://community.rapid7.com/community/infosec/blog/2016/02/02/security-vulnerabilities-within-fisher-price-smart-toy-hereo-gps-platform; https://www.kb.cert.org/vuls/id/719736; https://www.kb.cert.org/vuls/id/GWAN-A6LPPW
CVE: CVE-2016-1284
Published: 2016-02-04
Description: rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1034935; https://kb.isc.org/article/AA-01348; https://kb.isc.org/article/AA-01438
CVE: CVE-2015-2302
Published: 2016-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6405.  Reason: This candidate is a reservation duplicate of CVE-2014-6405.  Notes: All CVE users should reference CVE-2014-6405 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-2303
Published: 2016-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-6406.  Reason: This candidate is a reservation duplicate of CVE-2014-6406.  Notes: All CVE users should reference CVE-2014-6406 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-0861
Published: 2016-02-05
Description: General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf; http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html; http://seclists.org/fulldisclosure/2016/Feb/21
CVE: CVE-2016-0862
Published: 2016-02-05
Description: General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf; http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html; http://seclists.org/fulldisclosure/2016/Feb/21
CVE: CVE-2015-6553
Published: 2016-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn.  Further investigation showed that it was not a security issue in customer-controlled software.  Notes: none
CVE: CVE-2015-7914
Published: 2016-02-06
Description: Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.
CVSS Score: 8.1 (HIGH)
CWE: CWE-254, CWE-287
References: http://seclists.org/fulldisclosure/2016/Feb/25; https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01; http://seclists.org/fulldisclosure/2016/Feb/25
CVE: CVE-2015-7915
Published: 2016-02-06
Description: Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-255
References: http://seclists.org/fulldisclosure/2016/Feb/25; https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01; http://seclists.org/fulldisclosure/2016/Feb/25
CVE: CVE-2015-7916
Published: 2016-02-06
Description: Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2016/Feb/25; https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01; http://seclists.org/fulldisclosure/2016/Feb/25