yahoo-inc/cve-impacts huggingface dataset:
CVE-2015-4127: Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2015-4129: SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via modified serialized data, sql injection
CVE-2015-4132: Multiple cross-site scripting (XSS) vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2015-4133: Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by uploading a file, unrestricted file upload, direct request
CVE-2015-4134: Open redirect vulnerability in goto.php in phpwind 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Key phrases: redirect users to arbitrary web sites and conduct, open redirect, phishing
CVE-2015-4135: Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2015-4137: SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the program parameter, sql injection
CVE-2015-4138: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Key phrases: obtain potentially sensitive information, script access
CVE-2015-4139: Cross-site scripting (XSS) vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2015-4140: Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.
Key phrases: hijack the authentication of editors for requests that, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4141: The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), out-of-bounds read, heap-based buffer overflow, out of bounds read, heap based buffer overflow
CVE-2015-4142: Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Key phrases: denial of service (crash), cause a denial of service (crash), integer underflow, out-of-bounds read, out of bounds read
CVE-2015-4143: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
Key phrases: denial of service (out-of-bounds read and crash), cause a denial of service (out-, out of bounds read
CVE-2015-4144: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2015-4145: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Key phrases: denial of service (memory leak), cause a denial of service (memory leak
CVE-2015-4146: The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2015-4147: The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Key phrases: execute arbitrary code, execute arbitrary code by providing crafted serialized data, type confusion
CVE-2015-4148: The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Key phrases: obtain sensitive information, obtain sensitive information by providing crafted serialized data, type confusion
CVE-2015-4152: Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
Key phrases: write to arbitrary files via vectors related to, directory traversal
CVE-2015-4153: Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Key phrases: execute arbitrary php files, include and execute arbitrary php files via a, directory traversal
CVE-2015-4155: GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Key phrases: write to arbitrary files via a symlink attack
CVE-2015-4156: GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Key phrases: write to arbitrary files via a symlink attack
CVE-2015-4157: SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
Key phrases: denial of service (service termination), cause a denial of service (service termination, unspecified vectors
CVE-2015-4158: SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
Key phrases: denial of service (service termination), cause a denial of service (service termination, unspecified vectors
CVE-2015-4159: SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-4160: SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-4161: SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Key phrases: obtain sensitive information, gain privileges, unspecified functionality, unspecified impact, unknown vectors
CVE-2015-4162: XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.
Key phrases: obtain sensitive information, obtain sensitive information via crafted XML data, xml external entity (xxe)
CVE-2015-4163: GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.
Key phrases: denial of service (NULL pointer dereference), cause a denial of service (NULL pointer, null pointer dereference
CVE-2015-4164: The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
Key phrases: denial of service (large loop and system hang), cause a denial of service (large loop
CVE-2015-4165: The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Key phrases: create arbitrary snapshot metadata files, write to and create arbitrary snapshot metadata files, arbitrary code, execute code, execute arbitrary, execute arbitrary code
CVE-2015-4166: Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
Key phrases: have unspecified impact via vectors related to loss, loss of an encryption key
CVE-2015-4167: The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.
Key phrases: denial of service (incorrect data representation or integer overflow, and OOPS), cause a denial of service (incorrect data, oops
CVE-2015-4170: Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.
Key phrases: denial of service (ldsem_down_read and ldsem_down_write deadlock), cause a denial of service (ldsem_down_read and, race condition
CVE-2015-4171: strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Key phrases: obtain credentials, obtain credentials by using a valid certificate and
CVE-2015-4173: Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Key phrases: gain privileges, gain privileges via a Trojan horse program in, unquoted windows search path
CVE-2015-4174: Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2015-4176: fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.
Key phrases: read arbitrary files, read arbitrary files by leveraging user-namespace, user-namespace root access
CVE-2015-4177: The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.
Key phrases: denial of service (system crash), cause a denial of service (system crash, user-namespace root access
CVE-2015-4178: The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call, related to fs/fs_pin.c and include/linux/fs_pin.h.
Key phrases: denial of service (system crash), cause a denial of service (system crash, user-namespace root access
CVE-2015-4179: Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress.
Key phrases: cross-site request forgery (csrf), cross site request forgery
CVE-2015-4180: Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this vulnerability exists due to an incomplete fix to CVE-2009-4050.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2015-4181: Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2015-4182: The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
Key phrases: bypass intended access restrictions, obtain sensitive information, unspecified vectors
CVE-2015-4183: Cisco UCS Central Software 1.2(1a) allows local users to gain privileges for OS command execution via a crafted CLI parameter, aka Bug ID CSCut32795.
Key phrases: gain privileges, gain privileges for OS command execution via a
CVE-2015-4184: The anti-spam scanner on Cisco Email Security Appliance (ESA) devices 3.3.1-09, 7.5.1-gpl-022, and 8.5.6-074 allows remote attackers to bypass intended e-mail restrictions via a malformed DNS SPF record, aka Bug IDs CSCuu35853 and CSCuu37733.
Key phrases: bypass intended e-mail restrictions, bypass intended e-mail restrictions via a, malformed dns spf record
CVE-2015-4185: The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Key phrases: gain privileges, gain privileges by starting a session very soon, vty state
CVE-2015-4186: The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
Key phrases: gain privileges, gain privileges for OS command execution via a
CVE-2015-4188: SQL injection vulnerability in the Manager interface in Cisco Prime Collaboration 10.5(1) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug IDs CSCuu29910, CSCuu29928, and CSCuu59104.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via a crafted URL, sql injection
CVE-2015-4189: Cross-site request forgery (CSRF) vulnerability in Cisco Data Center Analytics Framework (DCAF) 1.4 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun26807.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4190: Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
Key phrases: modify data via unspecified vectors, man in the middle
CVE-2015-4191: Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet, aka Bug ID CSCuq95565.
Key phrases: denial of service (ipv6_io service reload), cause a denial of service (ipv6_io service, malformed packet
CVE-2015-4194: The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
Key phrases: obtain sensitive information, enumerate account names and obtain sensitive information via
CVE-2015-4195: Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127.
Key phrases: denial of service (vty error, and SSH and TELNET outage), cause a denial of service (vty error, ssh and telnet outage
CVE-2015-4196: Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.
Key phrases: obtain root access, obtain root access by leveraging knowledge of this, hardcoded password
CVE-2015-4197: Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network, aka Bug ID CSCud89415.
Key phrases: denial of service (device crash), cause a denial of service (device crash, malformed lldp packet
CVE-2015-4198: Cross-site scripting (XSS) vulnerability in the web framework on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross-site scripting (xss), unspecified
CVE-2015-4199: Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
Key phrases: denial of service (NULL pointer free and module crash), cause a denial of service (NULL pointer, race condition, null pointer free, intermittent connectivity
CVE-2015-4200: Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2015-4201: The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header, aka Bug ID CSCut68058.
Key phrases: denial of service (Session Manager restart), cause a denial of service (Session Manager, invalid tcp ip header
CVE-2015-4202: Cisco IOS 12.2SCH on uBR10000 router Cable Modem Termination Systems (CMTS) does not properly restrict access to the IP Detail Record (IPDR) service, which allows remote attackers to obtain potentially sensitive MAC address and network-utilization information via crafted IPDR packets, aka Bug ID CSCua39203.
Key phrases: obtain potentially sensitive MAC address and network-utilization information
CVE-2015-4203: Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine (PRE) module on uBR10000 devices, when NetFlow and an MPLS IPv6 VPN are configured, allows remote attackers to cause a denial of service (PXF process crash) by sending malformed MPLS 6VPE packets quickly, aka Bug ID CSCud83396.
Key phrases: denial of service (PXF process crash), cause a denial of service (PXF process, race condition
CVE-2015-4204: Memory leak in Cisco IOS 12.2 in the Performance Routing Engine (PRE) module on uBR10000 devices allows remote authenticated users to cause a denial of service (memory consumption or PXF process crash) by sending docsIfMCmtsMib SNMP requests quickly, aka Bug ID CSCue65051.
Key phrases: denial of service (memory consumption or PXF process crash), cause a denial of service (memory consumption, memory leak
CVE-2015-4205: Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE frames on the local network, aka Bug ID CSCut19959.
Key phrases: denial of service (NPU chip reset or line-card reload), cause a denial of service (NPU chip, npu chip reset
CVE-2015-4206: Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266.
Key phrases: bypass an XSS protection, bypass an XSS protection mechanism via a crafted, xss protection mechanism
CVE-2015-4207: Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147.
Key phrases: bypass intended attendance restrictions, obtain sensitive information, obtain sensitive information and bypass intended attendance restrictions
CVE-2015-4208: Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.
Key phrases: obtain sensitive information, obtain sensitive information or conduct SQL injection attacks, sql injection, read access
CVE-2015-4209: Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain sensitive information by obtaining a list of all meetings and then sending a calendar request for each one, aka Bug ID CSCur23913.
Key phrases: obtain sensitive information, obtain sensitive information by obtaining a list of
CVE-2015-4210: Cross-site scripting (XSS) vulnerability in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur03806.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2015-4211: Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
Key phrases: gain privileges, gain privileges via a crafted INF file
CVE-2015-4212: Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering credentials, aka Bug ID CSCut17466.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors
CVE-2015-4213: Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
Key phrases: discover cleartext passwords by leveraging the existence of, decryption mechanism
CVE-2015-4214: Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
Key phrases: discover cleartext passwords by reading HTML source code
CVE-2015-4215: Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (device crash) by triggering an exception during attempted forwarding of unspecified IPv6 packets to a non-IPv6 device, aka Bug ID CSCuj01046.
Key phrases: denial of service (device crash), cause a denial of service (device crash, exception, unspecified
CVE-2015-4216: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
Key phrases: bypass authentication
CVE-2015-4217: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
CVE-2015-4218: The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET request, aka Bug IDs CSCuu65622 and CSCuu70858.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted value in
CVE-2015-4219: Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.
Key phrases: obtain sensitive information, obtain sensitive information via brute-force attempts
CVE-2015-4220: Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq03773.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross-site scripting (xss), unspecified
CVE-2015-4221: Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a decryption attack, aka Bug ID CSCuq46194.
Key phrases: execute arbitrary commands, determine cleartext passwords, decryption, unspecified
CVE-2015-4222: SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-4223: Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) packets, aka Bug ID CSCuu77478.
Key phrases: denial of service (process reload), cause a denial of service (process reload
CVE-2015-4224: Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands in a privileged context, arbitrary os command
CVE-2015-4225: Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors
CVE-2015-4226: The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
Key phrases: denial of service (device hang), cause a denial of service (device hang, malformed rtp packets
CVE-2015-4227: Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91838.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak, unspecified
CVE-2015-4228: Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.
Key phrases: denial of service (reboot), cause a denial of service (reboot), malformed ad messages
CVE-2015-4229: The web framework in Cisco Unified Communications Domain Manager 8.1(4)ER1 allows remote attackers to obtain sensitive information by visiting a bvsmweb URL, aka Bug ID CSCuq22589.
Key phrases: obtain sensitive information, obtain sensitive information by visiting a bvsmweb URL, bvsmweb url
CVE-2015-4230: Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91854.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak, unspecified
CVE-2015-4231: The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.
Key phrases: bypass intended access restrictions, bypass intended access restrictions and delete an arbitrary
CVE-2015-4232: Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands by entering crafted tar, arbitrary os command
CVE-2015-4233: SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-4234: Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.
Key phrases: obtain root access, obtain root access via unspecified input to the
CVE-2015-4235: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991.
Key phrases: obtain root privileges, obtain root privileges via unspecified use of the
CVE-2015-4236: Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073, 8.5.6-074, and 9.0.0-461, when clustering is enabled, allows remote attackers to cause a denial of service (clustering and SSH outage) via a packet flood, aka Bug IDs CSCur13704 and CSCuq05636.
Key phrases: denial of service (clustering and SSH outage), cause a denial of service (clustering and, ssh outage, packet flood
CVE-2015-4237: The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via crafted characters in, bug ids, arbitrary os command
CVE-2015-4238: The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.
Key phrases: denial of service (device reload), cause a denial of service (device reload
CVE-2015-4239: Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.
Key phrases: denial of service (device reload), cause a denial of service (device reload
CVE-2015-4240: Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Key phrases: denial of service (service outage), cause a denial of service (service outage, unspecified url
CVE-2015-4241: Cisco Adaptive Security Appliance (ASA) Software 9.3(2) allows remote attackers to cause a denial of service (system reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCut52679.
Key phrases: denial of service (system reload), cause a denial of service (system reload
CVE-2015-4242: Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4243: The PPPoE establishment implementation in Cisco IOS XE 3.5.0S on ASR 1000 devices allows remote attackers to cause a denial of service (device reload) by sending malformed PPPoE Active Discovery Request (PADR) packets on the local network, aka Bug ID CSCty94202.
Key phrases: denial of service (device reload), cause a denial of service (device reload
CVE-2015-4244: The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for storage of these commands in a Compact Flash (CF) file, aka Bug ID CSCuu75278.
Key phrases: execute arbitrary Linux commands, execute arbitrary Linux commands by leveraging administrative privileges
CVE-2015-4252: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence ISDN Gateway devices with software 2.2(1.106) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90724.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4253: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Serial Gateway devices with software 1.0(1.42) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90728.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4254: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence Advanced Media Gateway devices with software 1.1(1.40) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90732.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4255: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90734.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4256: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP VCR devices with software 3.0(1.27) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90736.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4257: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MCU 4500 devices with software 4.5(1.55) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90710.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4258: Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MSE 8000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90444.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4259: The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug IDs CSCum56133 and CSCum56177.
Key phrases: bypass cryptographic protection, man in the middle
CVE-2015-4260: Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu14862.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2015-4262: The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.5(5) MR3 and 8.6 before 8.6(2) does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839.
Key phrases: reset arbitrary passwords, reset arbitrary passwords via a crafted HTTP request
CVE-2015-4263: The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851.
Key phrases: obtain sensitive information, obtain sensitive information by reading log files
CVE-2015-4265: Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets over the Inter-IC (I2C) bus, aka Bug ID CSCuq77241.
Key phrases: denial of service (host OS or BMC hang), cause a denial of service (host OS
CVE-2015-4266: The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.
Key phrases: clickjacking, unspecified other, cross-frame scripting (xfs)
CVE-2015-4267: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4268: Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2015-4269: The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending many requests, aka Bug ID CSCuu99709.
Key phrases: denial of service (management outage), cause a denial of service (management outage
CVE-2015-4270: Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.5 and 6.0.0 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuv22557, CSCuv22583, CSCuv22632, CSCuv22641, CSCuv22650, CSCuv22662, CSCuv22697, and CSCuv22702.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2015-4271: Cisco TelePresence TC before 7.3.4 on Integrator C devices allows remote attackers to bypass authentication via vectors involving multiple request parameters, aka Bug ID CSCuv00604.
Key phrases: bypass authentication, bypass authentication via vectors involving multiple request parameters
CVE-2015-4272: Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2.10000.5) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2015-4273: The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 15.0(912), 15.0(935), and 15.0(938) allows remote attackers to cause a denial of service (Session Manager outage) via malformed fields in an IP packet, aka Bug ID CSCut38476.
Key phrases: denial of service (Session Manager outage), cause a denial of service (Session Manager, malformed fields
CVE-2015-4274: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified Intelligence Center 10.0(1) and 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4275: The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet, aka Bug ID CSCut11534.
Key phrases: cause a denial of service via a malformed, malformed header
CVE-2015-4276: Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted command parameter
CVE-2015-4277: The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.
Key phrases: denial of service (tmp/*config file creation, memory consumption, and device hang), cause a denial of service (tmp/*config file, unspecified vectors
CVE-2015-4278: Cisco Email Security Appliance (ESA) devices with software 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a denial of service (per-domain e-mail reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain, aka Bug ID CSCuv14806.
Key phrases: denial of service (per-domain e-mail reception outage), cause a denial of service (per-, malformed dmarc policy data
CVE-2015-4279: The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.
Key phrases: executing arbitrary CLI commands, gain privileges, gain privileges for executing arbitrary CLI commands by, execute arbitrary
CVE-2015-4280: Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request, aka Bug ID CSCum38844.
Key phrases: denial of service (HTTP service outage), cause a denial of service (HTTP service, http service outage
CVE-2015-4281: Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.5 MR1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCus56150 and CSCus56146.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2015-4282: Cisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified binary files, which allows local users to obtain root privileges by writing to a file, aka Bug ID CSCuv40504.
Key phrases: obtain root privileges, obtain root privileges by writing to a file, weak permissions, unspecified, to write files