rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-2739 
The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T01:00:00.000Z
CVE-2015-2740 
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T01:00:00.000Z
CVE-2015-2741 
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T01:00:00.000Z
CVE-2015-2742 
Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T01:00:00.000Z
CVE-2015-2743 
PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-06T01:00:00.000Z
CVE-2015-2744 
Cross-site scripting (XSS) vulnerability in the Search app in Gaia in Mozilla Firefox OS before 2.2 allows remote attackers to inject arbitrary HTML via a crafted search link that is mishandled after re-opening the browser or opening the tab view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-08T00:00:00.000Z
CVE-2015-2745 
Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-08T00:00:00.000Z
CVE-2015-2746 
The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command, as demonstrated by the Destination parameter in the ping command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-26T14:00:00.000Z
CVE-2015-2747 
Multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview in Websense Triton 7.8.3 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via a crafted (1) email or (2) HTTP request, which triggers a DLP Policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-26T14:00:00.000Z
CVE-2015-2748 
Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-26T14:00:00.000Z
CVE-2015-2749 
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T16:00:00.000Z
CVE-2015-2750 
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T16:00:00.000Z
CVE-2015-2751 
Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2015-2752 
The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2015-2753 
FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T14:00:00.000Z
CVE-2015-2754 
FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T14:00:00.000Z
CVE-2015-2755 
Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2015-2756 
QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2015-2757 
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2758 
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2759 
Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2760 
Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2761 
Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2762 
Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2763 
Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to port 17703.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2764 
Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS (1) Mobile or (2) DLP report catalog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2765 
The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2766 
The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2767 
Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2768 
Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2769 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2770 
Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2771 
The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2772 
SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to upload arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2773 
SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-27T14:00:00.000Z
CVE-2015-2774 
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T21:00:00.000Z
CVE-2015-2775 
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-13T14:00:00.000Z
CVE-2015-2776 
The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T14:00:00.000Z
CVE-2015-2778 
Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-2779 
Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-2780 
Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T18:00:00.000Z
CVE-2015-2781 
Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T14:00:00.000Z
CVE-2015-2782 
Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T18:00:00.000Z
CVE-2015-2783 
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-09T18:00:00.000Z
CVE-2015-2784 
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T17:41:01.000Z
CVE-2015-2785 
The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T21:00:00.000Z
CVE-2015-2786 
Unspecified vulnerability in MyBB (aka MyBulletinBoard) before 1.8.4 has unknown attack vectors related to "Group join request notifications sent to wrong group leaders."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T21:00:00.000Z
CVE-2015-2787 
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2015-2788 
Multiple stack-based buffer overflows in the ib_fill_isqlda function in dbdimp.c in DBD-Firebird before 1.19 allow remote attackers to have unspecified impact via unknown vectors that trigger an error condition, related to binding octets to columns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T18:00:00.000Z
CVE-2015-2789 
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-2790 
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted (1) Ubyte Size in a DataSubBlock structure or (2) LZWMinimumCodeSize in a GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-2791 
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-2792 
The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-2793 
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ikiwiki
product: ikiwiki
Published: 2019-11-21T19:48:14.000Z
CVE-2015-2794 
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T15:00:00.000Z
CVE-2015-2796 
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T21:00:00.000Z
CVE-2015-2797 
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-19T14:00:00.000Z
CVE-2015-2798 
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-2800 
The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with software before V200R001SPH015 allows remote attackers to cause a denial of service (device restart) via vectors involving authentication, which trigger an array access violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2015-2802 
An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, and Asset Manager Cloudsystem Chargeback 9.40, which could let a remote malicious user obtain sensitive information. This is the TLS vulnerability known as the RC4 cipher Bar Mitzvah vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T20:09:48.000Z
CVE-2015-2803 
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3 allows remote authenticated users with permission to maintain acronyms to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T18:00:00.000Z
CVE-2015-2804 
The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-2805 
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-2806 
Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-2807 
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-2808 
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T00:00:00.000Z