rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-4112 
The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-19T11:00:00.000Z
CVE-2015-4116 
Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4117 
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T22:00:00.000Z
CVE-2015-4118 
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.  NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4119 
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4127 
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-4129 
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-05T10:00:00.000Z
CVE-2015-4132 
Multiple cross-site scripting (XSS) vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-4133 
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-4134 
Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-4135 
Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-4137 
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-29T14:00:00.000Z
CVE-2015-4138 
The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-30T19:00:00.000Z
CVE-2015-4139 
Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-18T18:00:00.000Z
CVE-2015-4140 
Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-18T18:00:00.000Z
CVE-2015-4141 
The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4142 
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4143 
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4144 
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4145 
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4146 
The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4147 
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-09T18:00:00.000Z
CVE-2015-4148 
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-09T18:00:00.000Z
CVE-2015-4152 
Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4153 
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-10T18:00:00.000Z
CVE-2015-4155 
GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4156 
GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4157 
SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4158 
SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4159 
SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4160 
SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4161 
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4162 
XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-02T14:00:00.000Z
CVE-2015-4163 
GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4164 
The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4165 
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T16:00:00.000Z
CVE-2015-4166 
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-4167 
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-05T18:00:00.000Z
CVE-2015-4170 
Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-4171 
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-10T18:00:00.000Z
CVE-2015-4173 
Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-26T19:00:00.000Z
CVE-2015-4174 
Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-28T10:00:00.000Z
CVE-2015-4176 
fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-4177 
The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-4178 
The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call, related to fs/fs_pin.c and include/linux/fs_pin.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-4179 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T16:00:00.000Z
CVE-2015-4180 
Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this vulnerability exists due to an incomplete fix to CVE-2009-4050.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2015-4181 
Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2015-4182 
The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T14:00:00.000Z
CVE-2015-4183 
Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T10:00:00.000Z
CVE-2015-4184 
The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-13T10:00:00.000Z
CVE-2015-4185 
The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-13T10:00:00.000Z
CVE-2015-4186 
The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T10:00:00.000Z
CVE-2015-4188 
SQL injection vulnerability in the Manager interface in Cisco Prime Collaboration 10.5(1) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug IDs CSCuu29910, CSCuu29928, and CSCuu59104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T10:00:00.000Z
CVE-2015-4189 
Cross-site request forgery (CSRF) vulnerability in Cisco Data Center Analytics Framework (DCAF) 1.4 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun26807.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-23T14:00:00.000Z
CVE-2015-4190 
Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T10:00:00.000Z
CVE-2015-4191 
Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet, aka Bug ID CSCuq95565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-19T01:00:00.000Z
CVE-2015-4194 
The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-19T01:00:00.000Z
CVE-2015-4195 
Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-19T01:00:00.000Z
CVE-2015-4196 
Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-04T10:00:00.000Z
CVE-2015-4197 
Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network, aka Bug ID CSCud89415.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-20T14:00:00.000Z
CVE-2015-4198 
Cross-site scripting (XSS) vulnerability in the web framework on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-20T14:00:00.000Z
CVE-2015-4199 
Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-27T10:00:00.000Z
CVE-2015-4200 
Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-23T10:00:00.000Z