rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-3130 
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3131 
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3132 
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3133 
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3134, and CVE-2015-4431.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3134 
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-4431.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3135 
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3136 
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3137 
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T16:00:00.000Z
CVE-2015-3138 
print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T18:00:00.000Z
CVE-2015-3140 
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T21:41:58.000Z
CVE-2015-3141 
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T19:00:00.000Z
CVE-2015-3142 
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-26T15:00:00.000Z
CVE-2015-3143 
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2015-3144 
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2015-3145 
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2015-3146 
The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T17:00:00.000Z
CVE-2015-3147 
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
Problem types: description: Symbolic Link Following
Affected products: vendor: ABRT
product: ABRT
Published: 2020-01-14T17:31:49.000Z
CVE-2015-3148 
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2015-3149 
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-3150 
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
Problem types: description: Other
Affected products: vendor: ABRT
product: ABRT
Published: 2020-01-14T17:34:43.000Z
CVE-2015-3151 
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: ABRT
product: ABRT
Published: 2020-01-14T17:47:12.000Z
CVE-2015-3152 
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-3153 
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T15:00:00.000Z
CVE-2015-3154 
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Problem types: description: CRLF Injection
Affected products: vendor: Zend Technologies
product: Zend Framework
Published: 2020-01-27T15:02:12.000Z
CVE-2015-3155 
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T18:00:00.000Z
CVE-2015-3156 
The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-11T21:00:00.000Z
CVE-2015-3158 
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-26T19:00:00.000Z
CVE-2015-3159 
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.
Problem types: description: Privilege
Affected products: vendor: ABRT
product: ABRT
Published: 2020-01-14T18:00:14.000Z
CVE-2015-3160 
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-3161 
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-3162 
Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitrary web script or HTML via writing a crafted comment on an acked or nacked canceled job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-3163 
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-3164 
The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-01T14:00:00.000Z
CVE-2015-3165 
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-3166 
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Problem types: description: Other
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2019-11-20T20:50:16.000Z
CVE-2015-3167 
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Problem types: description: Other
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2019-11-20T20:50:14.000Z
CVE-2015-3169 
Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T20:00:00.000Z
CVE-2015-3170 
selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-3171 
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-3172 
EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: EidoGo
Published: 2022-07-06T19:02:28.000Z
CVE-2015-3173 
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: custom-content-type-manager
Published: 2022-07-06T19:03:47.000Z
CVE-2015-3174 
mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3175 
Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3176 
The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3177 
Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3178 
Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3179 
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3180 
lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3181 
files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restrictions by using web services to perform uploads after this capability has been revoked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-3182 
epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-04T02:00:00.000Z
CVE-2015-3183 
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-20T23:00:00.000Z
CVE-2015-3184 
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-3185 
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-20T23:00:00.000Z
CVE-2015-3186 
Cross-site scripting (XSS) vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-02T19:00:00.000Z
CVE-2015-3187 
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z