rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-7323 
The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-05T15:00:00.000Z
CVE-2015-7324 
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-27T19:00:00.000Z
CVE-2015-7326 
XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z
CVE-2015-7327 
Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-24T01:00:00.000Z
CVE-2015-7328 
Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-7330 
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T21:00:00.000Z
CVE-2015-7331 
The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2015-7333 
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T14:05:01.000Z
CVE-2015-7334 
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T14:05:01.000Z
CVE-2015-7335 
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T14:05:01.000Z
CVE-2015-7336 
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T14:05:01.000Z
CVE-2015-7337 
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-29T19:00:00.000Z
CVE-2015-7338 
SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:24:28.000Z
CVE-2015-7339 
JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:23:05.000Z
CVE-2015-7340 
JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:21:22.000Z
CVE-2015-7341 
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:17:07.000Z
CVE-2015-7342 
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T16:16:01.000Z
CVE-2015-7343 
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T13:39:27.000Z
CVE-2015-7344 
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T13:35:36.000Z
CVE-2015-7346 
SQL injection vulnerability in ZCMS 1.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T21:00:00.000Z
CVE-2015-7347 
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T18:00:00.000Z
CVE-2015-7348 
Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-07T20:00:00.000Z
CVE-2015-7349 
Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T19:00:00.000Z
CVE-2015-7357 
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T19:00:00.000Z
CVE-2015-7358 
The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T19:00:00.000Z
CVE-2015-7359 
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T19:00:00.000Z
CVE-2015-7360 
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-26T15:00:00.000Z
CVE-2015-7361 
FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T20:00:00.000Z
CVE-2015-7362 
Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-7363 
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-07T14:00:00.000Z
CVE-2015-7364 
The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7365 
Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7366 
Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that (1) perform certain plugin actions and possibly cause a denial of service (disabled core plugins) via unknown vectors or (2) change the contact name and language or possibly have unspecified other impact via a crafted POST request to an account-user-*.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7367 
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been (1) deleted or (2) unlinked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7368 
Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7369 
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7370 
Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026, allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7371 
Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7372 
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7373 
Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T19:00:00.000Z
CVE-2015-7374 
The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-25T14:00:00.000Z
CVE-2015-7375 
Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled runtime exception and application crash) via a crafted Indusoft Project file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-25T14:00:00.000Z
CVE-2015-7377 
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-7378 
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T15:00:00.000Z
CVE-2015-7381 
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T01:00:00.000Z
CVE-2015-7382 
SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T01:00:00.000Z
CVE-2015-7383 
Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName, (2) pathToMYSQL, (3) databaseStructureFile, or (4) pathToBibutils parameter to install.php or the (5) adminUserName parameter to update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T01:00:00.000Z
CVE-2015-7384 
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T16:00:00.000Z
CVE-2015-7385 
Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-19T20:00:00.000Z
CVE-2015-7386 
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T15:00:00.000Z
CVE-2015-7387 
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T15:00:00.000Z
CVE-2015-7390 
SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-26T15:00:00.000Z
CVE-2015-7391 
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-26T15:00:00.000Z
CVE-2015-7392 
Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSON_Parse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-05T14:00:00.000Z
CVE-2015-7393 
dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM 11.3.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP DNS 12.0.0 before 12.0.0 HF1, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.0 through 11.3.0, BIG-IP GTM 11.2.0 through 11.6.0, BIG-IP PSM 11.2.0 through 11.4.1, Enterprise Manager 3.0.0 through 3.1.1, BIG-IQ Cloud 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ Security 4.0.0 through 4.5.0, BIG-IQ ADC 4.5.0, BIG-IQ Centralized Management 4.6.0, and BIG-IQ Cloud and Orchestration 1.0.0 allows local users with advanced shell (bash) access to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T20:00:00.000Z
CVE-2015-7394 
The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-06T18:00:00.000Z
CVE-2015-7395 
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended work-order change restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-08T02:00:00.000Z
CVE-2015-7396 
The Scheduler in IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.1 FP1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.1 FP1 for SmartCloud Control Desk allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or modify data, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-02T21:00:00.000Z
CVE-2015-7397 
Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-10T02:00:00.000Z
CVE-2015-7398 
Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-15T02:00:00.000Z
CVE-2015-7399 
IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-11T11:00:00.000Z
CVE-2015-7400 
The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-02T21:00:00.000Z