yahoo-inc/cve-impacts huggingface dataset:
CVE-2015-8072: mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, internal bug
CVE-2015-8073: mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability than CVE-2015-6608 and CVE-2015-8072.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, internal bug
CVE-2015-8074: mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611.
Key phrases: bypass an unspecified protection, consequently bypass, obtain sensitive information, unknown vectors, internal bugs
CVE-2015-8076: The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
Key phrases: obtain sensitive information, obtain sensitive information or possibly have unspecified other, unspecified other impact, out-of-bounds heap read, unspecified impact, out of bounds heap read
CVE-2015-8077: Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Key phrases: have unspecified impact via vectors related to urlfetch, integer overflow
CVE-2015-8078: Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Key phrases: have unspecified impact via vectors related to urlfetch, integer overflow
CVE-2015-8079: qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
Key phrases: private browsing urls
CVE-2015-8080: Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Key phrases: denial of service (memory corruption and application crash), bypass intended sandbox restrictions, run Lua code in a Redis session to, integer overflow, stack-based buffer overflow, stack based buffer overflow
CVE-2015-8081: The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
Key phrases: obtain sensitive field information, obtain sensitive field information by reading a cached, cached block
CVE-2015-8082: The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_logout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL Login modules.
Key phrases: bypass the logout protection, bypass the logout protection mechanism by leveraging a
CVE-2015-8083: An unspecified module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V200R003C00SPC300 does not properly initialize memory when processing timeout messages, which allows remote attackers to cause a denial of service (out-of-bounds memory access and device restart) via unknown vectors.
Key phrases: denial of service (out-of-bounds memory access and device restart), cause a denial of service (out-, unknown vectors, unspecified, out of bounds memory
CVE-2015-8084: Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface, allow remote attackers to cause a denial of service (reboot) via crafted DHCP packets.
Key phrases: denial of service (reboot), cause a denial of service (reboot), dhcp snooping, insert, rebuild
CVE-2015-8085: Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 make it easier for remote authenticated administrators to obtain and decrypt passwords by leveraging selection of a reversible encryption algorithm.
Key phrases: obtain and decrypt passwords
CVE-2015-8086: Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage.
Key phrases: obtain encryption keys and ciphertext passwords, vectors related to key storage
CVE-2015-8087: Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Key phrases: send packets to other VPNs and conduct flooding, vpn routing and forwarding (vrf) hopping
CVE-2015-8088: Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.
Key phrases: execute arbitrary code, denial of service (reboot), cause a denial of service (reboot), heap-based buffer overflow, heap based buffer overflow
CVE-2015-8089: The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations and consequently cause a denial of service (system crash) or gain privileges via a crafted application.
Key phrases: denial of service (system crash), gain privileges, read or write to arbitrary kernel memory locations
CVE-2015-8090: The Web Server component in TIBCO LogLogic Unity before 1.1.1 allows remote authenticated users to gain privileges, and consequently obtain sensitive information, via an HTTP request.
Key phrases: obtain sensitive information, gain privileges
CVE-2015-8094: Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter.
Key phrases: redirect users to arbitrary web sites and conduct, open redirect, phishing
CVE-2015-8095: The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
Key phrases: obtain sensitive information, obtain sensitive information via an unspecified URL pattern, unspecified url pattern
CVE-2015-8096: Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to "phase one 0x412 tag," which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors related to, integer overflow, heap-based buffer overflow, heap based buffer overflow
CVE-2015-8098: F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability."
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, out-of-bounds memory, unspecified, out of bounds memory
CVE-2015-8099: F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP DNS 12.x before 12.0.0 HF1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0; BIG-IP GTM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 HF10; Enterprise Manager 3.0.0 through 3.1.1; BIG-IQ Cloud and BIG-IQ Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 on the 3900, 6900, 8900, 8950, 11000, 11050, PB100 and PB200 platforms, when software SYN cookies are configured on virtual servers, allow remote attackers to cause a denial of service (High-Speed Bridge hang) via an invalid TCP segment.
Key phrases: denial of service (High-Speed Bridge hang), cause a denial of service (High-, invalid tcp segment
CVE-2015-8100: The net-snmp package in OpenBSD through 5.8 uses 0644 permissions for snmpd.conf, which allows local users to obtain sensitive community information by reading this file.
Key phrases: obtain sensitive community information, obtain sensitive community information by reading this file, permissions
CVE-2015-8103: The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Key phrases: execute arbitrary code, execute arbitrary code via a crafted serialized Java
CVE-2015-8104: The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.
Key phrases: denial of service (host OS panic or hang), cause a denial of service (host OS
CVE-2015-8105: Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss), file upload
CVE-2015-8106: Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \\\\keywords command in a crafted TeX file.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2015-8107: Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code, format string
CVE-2015-8108: The management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, px4-400r, and px4-300d NAS devices with firmware before 4.1.204.33661 allows remote attackers to obtain sensitive device information via unspecified vectors.
Key phrases: obtain sensitive device information, obtain sensitive device information via unspecified vectors
CVE-2015-8109: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX account credentials that requires knowledge of the time that this account was created, aka a "temporary administrator account vulnerability."
Key phrases: gain privileges, gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX, temporary administrator account
CVE-2015-8110: Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."
Key phrases: gain privileges, gain privileges by navigating to (1), local privilege escalation
CVE-2015-8113: Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path
CVE-2015-8124: Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.
Key phrases: hijack web sessions via a session id., session fixation
CVE-2015-8125: Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.
Key phrases: have unspecified impact via a timing attack involving
CVE-2015-8126: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflows, unspecified other impact, unspecified impact
CVE-2015-8131: Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Key phrases: hijack the authentication of unspecified victims via unknown, cross-site request forgery (csrf), unknown vectors, cross site request forgery
CVE-2015-8138: NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.
Key phrases: bypass the origin timestamp validation, bypass the origin timestamp validation via a packet
CVE-2015-8139: ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Key phrases: obtain origin timestamps and then impersonate peers via unspecified vectors
CVE-2015-8140: The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.
Key phrases: conduct replay attacks by sniffing the network
CVE-2015-8148: The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.
Key phrases: obtain sensitive information, obtain sensitive information about administrator accounts via a, modified request
CVE-2015-8149: The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory corruption and service outage) via crafted requests.
Key phrases: denial of service (heap memory corruption and service outage), cause a denial of service (heap memory
CVE-2015-8150: Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.
Key phrases: obtain root access, obtain root access by modifying a batch file
CVE-2015-8151: Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands by leveraging console administrator, arbitrary os commands, console administrator access
CVE-2015-8152: Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
Key phrases: execute arbitrary code, hijack the authentication of administrators for requests that, cross-site request forgery (csrf), cross site request forgery
CVE-2015-8153: SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-8154: The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted HTML document, rwx permissions
CVE-2015-8156: Unquoted Windows search path vulnerability in EEDService in Symantec Endpoint Encryption (SEE) 11.x before 11.1.1 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe.
Key phrases: gain privileges, gain privileges via a Trojan horse executable file, windows search path
CVE-2015-8157: SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2015-8158: The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2015-8212: CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.
Key phrases: execute arbitrary code, execute arbitrary code via crafted arguments, cgi handling flaw
CVE-2015-8213: The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Key phrases: obtain sensitive application secrets via a settings key
CVE-2015-8214: A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs.
Key phrases: perform administrative operations on the CPs if network, simatic net cp, simatic net cp advanced
CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272.  NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.
Key phrases: denial of service (packet loss), cause a denial of service (packet loss
CVE-2015-8216: The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
Key phrases: denial of service (out-of-bounds array access), cause a denial of service (out-, unspecified other impact, unspecified impact
CVE-2015-8217: The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.
Key phrases: denial of service (out-of-bounds array access), cause a denial of service (out-, unspecified other impact, unspecified impact
CVE-2015-8218: The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.
Key phrases: denial of service (out-of-bounds array access), cause a denial of service (out-, unspecified other impact, unspecified impact
CVE-2015-8219: The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Key phrases: denial of service (out-of-bounds array access), cause a denial of service (out-, unspecified other impact, unspecified impact
CVE-2015-8220: Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted commandline argument, stack-based buffer overflow, stack based buffer overflow
CVE-2015-8221: Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via the CAMF section in, integer overflow, heap-based buffer overflow, heap based buffer overflow
CVE-2015-8222: The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
Key phrases: gain privileges, gain privileges via unspecified vectors, world-readable permissions
CVE-2015-8223: Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver.
Key phrases: denial of service (OS crash), cause a denial of service (OS crash, camera permissions
CVE-2015-8224: Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.
Key phrases: obtain user equipment (aka UE) measurements
CVE-2015-8225: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2015-8226: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2015-8227: The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.
Key phrases: obtain sensitive information, obtain sensitive information or cause a denial of, denial of service
CVE-2015-8228: Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors.
Key phrases: access arbitrary directories, access arbitrary directories via unspecified vectors, directory traversal
CVE-2015-8229: Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated users to cause a denial of service via crafted signaling packets from a registered device.
Key phrases: cause a denial of service via crafted signaling
CVE-2015-8230: Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets.
Key phrases: denial of service (memory consumption and restart), cause a denial of service (memory consumption, memory leak
CVE-2015-8231: Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established sessions to cause a denial of service (device restart) via unspecified packets.
Key phrases: denial of service (device restart), cause a denial of service (device restart, established sessions, unspecified packets
CVE-2015-8232: The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors.
Key phrases: obtain sensitive information, obtain sensitive information from the anonymous user profile, unspecified vectors
CVE-2015-8233: Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2015-8234: The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.
Key phrases: bypass the signature verification, bypass the signature verification process via a crafted, collision
CVE-2015-8235: Directory traversal vulnerability in Spiffy before 5.4.
Key phrases: directory traversal
CVE-2015-8236: Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Key phrases: execute arbitrary code, execute arbitrary code as root by leveraging management, management-plane access
CVE-2015-8239: The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Key phrases: parts of the called command to replace them
CVE-2015-8240: The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
Key phrases: cause a denial of service via unspecified vectors
CVE-2015-8241: The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Key phrases: denial of service (heap-based buffer over-read and application crash), obtain sensitive information, cause a denial of service (heap-, buffer over read
CVE-2015-8242: The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Key phrases: denial of service (stack-based buffer over-read and application crash), obtain sensitive information, cause a denial of service (stack-, buffer over read
CVE-2015-8247: Cross-site scripting (XSS) vulnerability in synnefoclient in Synnefo Internet Management Software (IMS) 2015 allows remote attackers to inject arbitrary web script or HTML via the plan_name parameter to packagehistory/listusagesdata.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2015-8249: The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.
Key phrases: execute arbitrary files, upload and execute arbitrary files via the ConnectionId
CVE-2015-8251: OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G HFA V3, and OpenScape Desk Phone IP 35G Eco HFA V3 use non-unique X.509 certificates and SSH host keys.
Key phrases: ssh host keys
CVE-2015-8252: The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number.
Key phrases: determine a hardcoded key by sniffing the network, cleartext serial number
CVE-2015-8253: The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network.
Key phrases: obtain sensitive (1) message or (2, cleartext
CVE-2015-8254: The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Key phrases: integrity protection, false alarm, man in the middle
CVE-2015-8255: AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
Key phrases: CSRF, csrf
CVE-2015-8256: Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
Key phrases: cross-site scripting (xss)
CVE-2015-8257: The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2015-8258: AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."
Key phrases: modify arbitrary files, modify arbitrary files as root via vectors involving, resource injection
CVE-2015-8261: The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request.
Key phrases: conduct SQL injection attacks via a crafted SOAP, sql injection
CVE-2015-8262: Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.
Key phrases: improper algorithm, spoofing
CVE-2015-8263: NETGEAR WNR1000v3 devices with firmware 1.0.2.68 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port.
Key phrases: source port number, spoofing
CVE-2015-8264: Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.
Key phrases: execute arbitrary code, execute arbitrary code and conduct DLL hijacking attacks, untrusted search path
CVE-2015-8265: Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B310D01SP00C00 allow DNS query packets using the static source port, which makes it easier for remote attackers to spoof responses via unspecified vectors.
Key phrases: spoof responses via unspecified vectors, static source port, spoofing
CVE-2015-8267: The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.
Key phrases: reset arbitrary passwords, reset arbitrary passwords via a crafted request with, self password reset
CVE-2015-8268: The up.time agent in Idera Uptime Infrastructure Monitor 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors
CVE-2015-8269: The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number.
Key phrases: obtain sensitive information, obtain sensitive information or modify data by leveraging
CVE-2015-8270: The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
Key phrases: denial of service (invalid pointer dereference and process crash), cause a denial of service (invalid pointer
CVE-2015-8271: The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2015-8272: RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash).
Key phrases: denial of service (NULL pointer dereference and process crash), trigger a denial of service (NULL pointer, null pointer dereference
CVE-2015-8275: LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Key phrases: write to arbitrary files via crafted EDOC files
CVE-2015-8276: LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.
Key phrases: read arbitrary files, read arbitrary files via crafted EDOC files
CVE-2015-8277: Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted packet with, multiple buffer overflows
CVE-2015-8279: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
Key phrases: read arbitrary files, read arbitrary files via a request to an, unspecified
CVE-2015-8280: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
Key phrases: discover credentials by reading detailed error messages
CVE-2015-8281: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
Key phrases: bypass filesystem encryption via XOR calculations, xor calculations
CVE-2015-8282: SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account.
Key phrases: default password
CVE-2015-8283: Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00.
Key phrases: directory traversal
CVE-2015-8284: SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
Key phrases: perform administrative functions
CVE-2015-8285: The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
Key phrases: cause a denial of service
CVE-2015-8286: Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
Key phrases: obtain access, hardcoded root password
CVE-2015-8287: Swann SRNVW-470LCD devices with firmware through 0114 and SWNVW-470CAM devices with firmware through 1022 allow remote attackers to watch live video by visiting an unspecified URL.
Key phrases: watch live video by visiting an unspecified URL, unspecified url
CVE-2015-8288: NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Key phrases: defeat cryptographic protection mechanisms by leveraging knowledge of, hardcoded private key
CVE-2015-8289: The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.
Key phrases: discover the cleartext administrator password by reading the
CVE-2015-8298: Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2015-8299: Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted KNXnet/, buffer overflow
CVE-2015-8300: Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\\\\polycom\\\\polycom btoe connector\\\\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
Key phrases: gain privileges, gain privileges via a Trojan horse file, weak permissions
CVE-2015-8303: Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local users to obtain sensitive information by pasting the contents to another file.
Key phrases: obtain sensitive information, obtain sensitive information by pasting the contents to
CVE-2015-8304: Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted application with the system or camera permission.
Key phrases: gain privileges, gain privileges via a crafted application with the, integer overflow
CVE-2015-8305: Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera privilege.
Key phrases: denial of service (system panic), cause a denial of service (system panic, camera privilege
CVE-2015-8306: Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.
Key phrases: execute arbitrary code, denial of service (system crash), cause a denial of service (system crash, buffer overflow, unspecified
CVE-2015-8307: The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an "interface access control vulnerability," a different vulnerability than CVE-2015-8680.
Key phrases: denial of service (system crash), gain privileges, cause a denial of service (system crash, interface access control
CVE-2015-8308: LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
Key phrases: bypass authentication, bypass authentication with X connections
CVE-2015-8309: Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Key phrases: read arbitrary files, read arbitrary files via the "value", directory traversal
CVE-2015-8310: Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2015-8312: Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
Key phrases: denial of service (memory overwrite and system crash), cause a denial of service (memory overwrite
CVE-2015-8313: GnuTLS incorrectly validates the first byte of padding in CBC modes
CVE-2015-8314: The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Key phrases: obtain unauthorized persistent application access, remember me cookies
CVE-2015-8315: The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, long version string, denial of service (redos)
CVE-2015-8316: Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
Key phrases: denial of service (process crash), cause a denial of service (process crash, array index error
CVE-2015-8317: The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Key phrases: obtain sensitive information, obtain sensitive information via an (1), unterminated encoding value, out-of-bounds heap read, out of bounds heap read
CVE-2015-8318: Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8319.
Key phrases: denial of service (system crash), gain privileges, cause a denial of service (system crash, heap-based buffer overflow, heap based buffer overflow