rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-4548 
EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-12T01:00:00.000Z
CVE-2015-4550 
The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T10:00:00.000Z
CVE-2015-4551 
LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-10T16:00:00.000Z
CVE-2015-4552 
Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T17:00:00.000Z
CVE-2015-4553 
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T20:54:57.000Z
CVE-2015-4554 
Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-21T19:00:00.000Z
CVE-2015-4555 
Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Rendezvous Daemon (rvd), Routing Daemon (rvrd), Secure Daemon (rvsd), Secure Routing Daemon (rvsrd), Gateway Daemon (rvgd), Daemon Adapter (rvda), Cache (rvcache), Agent (rva), and Relay Agent (rvrad) components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-30T14:00:00.000Z
CVE-2015-4556 
The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T14:00:00.000Z
CVE-2015-4557 
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.  NOTE: this may overlap CVE-2015-4413.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T15:00:00.000Z
CVE-2015-4559 
Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-15T15:00:00.000Z
CVE-2015-4582 
The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: TheCartPress
product: boot-store
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-04-28T00:00:00.000Z
CVE-2015-4586 
Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote attackers to hijack the authentication of administrators for requests that create a user account via an add_user action in a request to password.cmd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-23T14:00:00.000Z
CVE-2015-4587 
Cross-site scripting (XSS) vulnerability in the Alcatel-Lucent CellPipe 7130 router with firmware 1.0.0.20h.HOL allows remote attackers to inject arbitrary web script or HTML via the "Custom application" field in the "port triggering" menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-18T18:00:00.000Z
CVE-2015-4588 
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-01T14:00:00.000Z
CVE-2015-4590 
The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-22T18:00:00.000Z
CVE-2015-4591 
eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated users to inject arbitrary javascript via the strMessage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T15:00:00.000Z
CVE-2015-4592 
eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T15:00:00.000Z
CVE-2015-4593 
eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T15:00:00.000Z
CVE-2015-4594 
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T15:00:00.000Z
CVE-2015-4596 
Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T16:00:00.000Z
CVE-2015-4598 
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4599 
The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4600 
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4601 
PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4602 
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4603 
The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4604 
The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4605 
The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2015-4606 
Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4607 
Unrestricted file upload vulnerability in the Frontend User Upload (feupload) extension 0.5.0 and earlier for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension using a frontend form, then accessing it via a direct request to the file in the fileadmin folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4608 
Cross-site scripting (XSS) vulnerability in the BE User Log (beko_beuserlog) extension 1.1.1 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4609 
SQL injection vulnerability in the wt_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4610 
SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4611 
SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4612 
SQL injection vulnerability in the "FAQ - Frequently Asked Questions" (js_faq) extension before 1.2.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4613 
SQL injection vulnerability in the backend module in the Developer Log (devlog) extension before 2.11.4 for TYPO3 allows remote editors to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-16T16:00:00.000Z
CVE-2015-4614 
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T16:00:00.000Z
CVE-2015-4615 
Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
Problem types: description: SQL Injection in easy2map-photos wordpress plugin v1.09
Affected products: vendor: Steven Ellis
product: Easy2map-photos WordPress Plugin
Published: 2019-02-15T21:00:00.000Z
CVE-2015-4616 
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T16:00:00.000Z
CVE-2015-4617 
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
Problem types: description: Path traversal in easy2map-photos wordpress plugin v1.09
Affected products: vendor: Steven Ellis
product: Easy2map-photos WordPress Plugin
Published: 2019-02-15T21:00:00.000Z
CVE-2015-4619 
Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T20:00:00.000Z
CVE-2015-4620 
name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T14:00:00.000Z
CVE-2015-4624 
Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T15:00:00.000Z
CVE-2015-4625 
Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-26T19:00:00.000Z
CVE-2015-4626 
B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2015-4627 
SQL injection vulnerability in Pragyan CMS 3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T20:00:00.000Z
CVE-2015-4628 
SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-18T10:00:00.000Z
CVE-2015-4629 
Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T20:00:00.000Z
CVE-2015-4630 
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for requests that create a user via a request to members/memberentry.pl or (2) give a user superlibrarian permission via a request to members/member-flags.pl or (3) hijack the authentication of arbitrary users for requests that conduct cross-site scripting (XSS) attacks via the addshelf parameter to opac-shelves.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-18T20:00:00.000Z
CVE-2015-4631 
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-18T20:00:00.000Z
CVE-2015-4632 
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-18T20:00:00.000Z
CVE-2015-4633 
Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-18T20:00:00.000Z
CVE-2015-4634 
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-11T14:00:00.000Z
CVE-2015-4637 
The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-16T14:00:00.000Z
CVE-2015-4638 
The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 through 11.3.0, and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restart) via a fragmented packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T14:00:00.000Z
CVE-2015-4639 
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-4640 
The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response.  NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-19T14:00:00.000Z