[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1317.

[Assistant] Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1317?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1317?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1318 mean in the context of cybersecurity?

[Assistant] CVE-2015-1318


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1318.

[Assistant] The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1318?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1318?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1319 mean in the context of cybersecurity?

[Assistant] CVE-2015-1319


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1319.

[Assistant] The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1319?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1319?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1320 mean in the context of cybersecurity?

[Assistant] CVE-2015-1320


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1320.

[Assistant] The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1320?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1320?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1321 mean in the context of cybersecurity?

[Assistant] CVE-2015-1321


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1321.

[Assistant] Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1321?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1321?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1322 mean in the context of cybersecurity?

[Assistant] CVE-2015-1322


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1322.

[Assistant] Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1322?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1322?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1323 mean in the context of cybersecurity?

[Assistant] CVE-2015-1323


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1323.

[Assistant] The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1323?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1323?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1324 mean in the context of cybersecurity?

[Assistant] CVE-2015-1324


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1324.

[Assistant] Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1324?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1324?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1325 mean in the context of cybersecurity?

[Assistant] CVE-2015-1325


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1325.

[Assistant] Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1325?

[Assistant] [oss-security] 20150521 CVE-2015-1325 apport race conditions / ubuntu local root


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1325?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1326 mean in the context of cybersecurity?

[Assistant] CVE-2015-1326


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1326.

[Assistant] python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1326?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1326?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1327 mean in the context of cybersecurity?

[Assistant] CVE-2015-1327


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1327.

[Assistant] Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1327?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1327?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1328 mean in the context of cybersecurity?

[Assistant] CVE-2015-1328


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1328.

[Assistant] The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1328?

[Assistant] [oss-security] 20150616 CVE-2015-1328: incorrect permission checks in overlayfs, ubuntu local root


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1328?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1329 mean in the context of cybersecurity?

[Assistant] CVE-2015-1329


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1329.

[Assistant] Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1329?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1329?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1330 mean in the context of cybersecurity?

[Assistant] CVE-2015-1330


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1330.

[Assistant] unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1330?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1330?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1331 mean in the context of cybersecurity?

[Assistant] CVE-2015-1331


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1331.

[Assistant] lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1331?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1331?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1332 mean in the context of cybersecurity?

[Assistant] CVE-2015-1332


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1332.

[Assistant] The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1332?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1332?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1333 mean in the context of cybersecurity?

[Assistant] CVE-2015-1333


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1333.

[Assistant] Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1333?

[Assistant] [oss-security] 20150727 Security issue in Linux Kernel Keyring (CVE-2015-1333)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1333?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1334 mean in the context of cybersecurity?

[Assistant] CVE-2015-1334


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1334.

[Assistant] attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1334?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1334?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1335 mean in the context of cybersecurity?

[Assistant] CVE-2015-1335


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1335.

[Assistant] lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1335?

[Assistant]
[lxc-devel] 20150929 LXC security issue - affects all supported releases

[oss-security] 20150929 Security issue in LXC (CVE-2015-1335)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1335?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1336 mean in the context of cybersecurity?

[Assistant] CVE-2015-1336


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1336.

[Assistant] The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1336?

[Assistant] [oss-security] 20151214 Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1336?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1337 mean in the context of cybersecurity?

[Assistant] CVE-2015-1337


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1337.

[Assistant] Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1337?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1337?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1338 mean in the context of cybersecurity?

[Assistant] CVE-2015-1338


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1338.

[Assistant] kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1338?

[Assistant] 20150927 Apport kernel_crashdump symlink vulnerability exploitation


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1338?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1339 mean in the context of cybersecurity?

[Assistant] CVE-2015-1339


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1339.

[Assistant] Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1339?

[Assistant] [oss-security] 20160302 CVE-2015-1339: Linux Kernel: memory exhaustion via CUSE driver


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1339?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1340 mean in the context of cybersecurity?

[Assistant] CVE-2015-1340


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1340.

[Assistant] LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1340?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1340?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1341 mean in the context of cybersecurity?

[Assistant] CVE-2015-1341


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1341.

[Assistant] Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1341?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1341?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1342 mean in the context of cybersecurity?

[Assistant] CVE-2015-1342


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1342.

[Assistant] LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1342?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1342?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1343 mean in the context of cybersecurity?

[Assistant] CVE-2015-1343


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1343.

[Assistant] All versions of unity-scope-gdrive logs search terms to syslog.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1343?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1343?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1344 mean in the context of cybersecurity?

[Assistant] CVE-2015-1344


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1344.

[Assistant] The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1344?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1344?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1345 mean in the context of cybersecurity?

[Assistant] CVE-2015-1345


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1345.

[Assistant] The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1345?

[Assistant] [oss-security] 20150122 Re: CVE request: grep heap buffer overrun


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1345?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1346 mean in the context of cybersecurity?

[Assistant] CVE-2015-1346


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1346.

[Assistant] Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1346?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1346?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1347 mean in the context of cybersecurity?

[Assistant] CVE-2015-1347


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1347.

[Assistant] Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1347?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1347?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1348 mean in the context of cybersecurity?

[Assistant] CVE-2015-1348


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1348.

[Assistant] Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1348?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1348?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1349 mean in the context of cybersecurity?

[Assistant] CVE-2015-1349


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1349.

[Assistant] named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1349?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1349?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1350 mean in the context of cybersecurity?

[Assistant] CVE-2015-1350


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1350.

[Assistant] The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1350?

[Assistant]
[linux-kernel] 20150117 [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks

[oss-security] 20150124 Re: CVE Request: Linux kernel - Denial of service in notify_change for xattrs.


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1350?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1351 mean in the context of cybersecurity?

[Assistant] CVE-2015-1351


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1351.

[Assistant] Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1351?

[Assistant] [oss-security] 20150124 Re: CVE Request: PHP


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1351?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1352 mean in the context of cybersecurity?

[Assistant] CVE-2015-1352


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1352.

[Assistant] The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1352?

[Assistant] [oss-security] 20150124 Re: CVE Request: PHP


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1352?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1353 mean in the context of cybersecurity?

[Assistant] CVE-2015-1353


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1353.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1353?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1353?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1355 mean in the context of cybersecurity?

[Assistant] CVE-2015-1355


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1355.

[Assistant] Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1355?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1355?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1356 mean in the context of cybersecurity?

[Assistant] CVE-2015-1356


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1356.

[Assistant] Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1356?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1356?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1357 mean in the context of cybersecurity?

[Assistant] CVE-2015-1357


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1357.

[Assistant] Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1357?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1357?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1358 mean in the context of cybersecurity?

[Assistant] CVE-2015-1358


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1358.

[Assistant] The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1358?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1358?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1359 mean in the context of cybersecurity?

[Assistant] CVE-2015-1359


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1359.

[Assistant] Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1359?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1359?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1360 mean in the context of cybersecurity?

[Assistant] CVE-2015-1360


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1360.

[Assistant] Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1360?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1360?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1361 mean in the context of cybersecurity?

[Assistant] CVE-2015-1361


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1361.

[Assistant] platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1361?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1361?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1362 mean in the context of cybersecurity?

[Assistant] CVE-2015-1362


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1362.

[Assistant] Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1362?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1362?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1363 mean in the context of cybersecurity?

[Assistant] CVE-2015-1363


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1363.

[Assistant] Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1363?

[Assistant] 20150122 XSS vulnerability in articleFR CMS 3.0.5


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1363?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1364 mean in the context of cybersecurity?

[Assistant] CVE-2015-1364


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1364.

[Assistant] SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1364?

[Assistant] 20150121 SQL injection vulnerability in articleFR CMS 3.0.5


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1364?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1365 mean in the context of cybersecurity?

[Assistant] CVE-2015-1365


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1365.

[Assistant] Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1365?

[Assistant]
20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1365?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1366 mean in the context of cybersecurity?

[Assistant] CVE-2015-1366


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1366.

[Assistant] Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1366?

[Assistant]
20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1366?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1367 mean in the context of cybersecurity?

[Assistant] CVE-2015-1367


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1367.

[Assistant] SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1367?

[Assistant]
20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability

20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1367?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1368 mean in the context of cybersecurity?

[Assistant] CVE-2015-1368


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1368.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1368?

[Assistant]
20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower

20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1368?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1369 mean in the context of cybersecurity?

[Assistant] CVE-2015-1369


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1369.

[Assistant] SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1369?

[Assistant] [oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize  SQL Injection in Order


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1369?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1370 mean in the context of cybersecurity?

[Assistant] CVE-2015-1370


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1370.

[Assistant] Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1370?

[Assistant] [oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize  SQL Injection in Order


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1370?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1371 mean in the context of cybersecurity?

[Assistant] CVE-2015-1371


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1371.

[Assistant] Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1371?

[Assistant]
[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload

20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1371?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1372 mean in the context of cybersecurity?

[Assistant] CVE-2015-1372


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1372.

[Assistant] SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1372?

[Assistant]
[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload

20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1372?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1373 mean in the context of cybersecurity?

[Assistant] CVE-2015-1373


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1373.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1373?

[Assistant]
[oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload

20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1373?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1374 mean in the context of cybersecurity?

[Assistant] CVE-2015-1374


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1374.

[Assistant] Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1374?

[Assistant] [oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1374?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1375 mean in the context of cybersecurity?

[Assistant] CVE-2015-1375


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1375.

[Assistant] pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1375?

[Assistant]
20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1375?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1376 mean in the context of cybersecurity?

[Assistant] CVE-2015-1376


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1376.

[Assistant] pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1376?

[Assistant]
20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

[oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1376?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1377 mean in the context of cybersecurity?

[Assistant] CVE-2015-1377


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1377.

[Assistant] The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1377?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1377?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1378 mean in the context of cybersecurity?

[Assistant] CVE-2015-1378


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1378.

[Assistant] cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1378?

[Assistant] [oss-security] 20150127 Re: CVE or not: 2x grml-debootstrap


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1378?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1379 mean in the context of cybersecurity?

[Assistant] CVE-2015-1379


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1379.

[Assistant] The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1379?

[Assistant]
[oss-security] 20150406 Socat security advisory 6 - Possible DoS with fork (update: CVE-Id: CVE-2015-1379; fix for version 2)

[oss-security] 20150127 Re: Socat security advisory 6 - Possible DoS with fork


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1379?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1380 mean in the context of cybersecurity?

[Assistant] CVE-2015-1380


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1380.

[Assistant] jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1380?

[Assistant]
[oss-security] 20150126 CVE request for Privoxy

[oss-security] 20150127 Re: CVE request for Privoxy


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1380?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1381 mean in the context of cybersecurity?

[Assistant] CVE-2015-1381


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1381.

[Assistant] Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1381?

[Assistant]
[oss-security] 20150126 CVE request for Privoxy

[oss-security] 20150127 Re: CVE request for Privoxy


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1381?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1382 mean in the context of cybersecurity?

[Assistant] CVE-2015-1382


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1382.

[Assistant] parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1382?

[Assistant]
[oss-security] 20150126 CVE request for Privoxy

[oss-security] 20150127 Re: CVE request for Privoxy


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1382?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1383 mean in the context of cybersecurity?

[Assistant] CVE-2015-1383


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1383.

[Assistant] Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1383?

[Assistant]
20150128 Wordpress Geo Mashup plugin <= 1.8.2 XSS vulnerability

[oss-security] 20150127 Re: CVE request: XSS in search functionality for Geo Mashup Wordpress plugin


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1383?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1384 mean in the context of cybersecurity?

[Assistant] CVE-2015-1384


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1384.

[Assistant] Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1384?

[Assistant]
20150131 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384

20150201 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1384?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1385 mean in the context of cybersecurity?

[Assistant] CVE-2015-1385


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1385.

[Assistant] Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1385?

[Assistant]
20150129 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385

20150130 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1385?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1386 mean in the context of cybersecurity?

[Assistant] CVE-2015-1386


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1386.

[Assistant] Directory traversal vulnerability in unshield 1.0-1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1386?

[Assistant] [oss-security] 20150127 Re: unshield directory traversal


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1386?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1387 mean in the context of cybersecurity?

[Assistant] CVE-2015-1387


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1387.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1387?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1387?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1388 mean in the context of cybersecurity?

[Assistant] CVE-2015-1388


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1388.

[Assistant] The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1388?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1388?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1389 mean in the context of cybersecurity?

[Assistant] CVE-2015-1389


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1389.

[Assistant] Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1389?

[Assistant] 20150527 ClearPass Policy Manager Stored XSS


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1389?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1390 mean in the context of cybersecurity?

[Assistant] CVE-2015-1390


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1390.

[Assistant] Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1390?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1390?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1391 mean in the context of cybersecurity?

[Assistant] CVE-2015-1391


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1391.

[Assistant] Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1391?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1391?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1392 mean in the context of cybersecurity?

[Assistant] CVE-2015-1392


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1392.

[Assistant] Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1392?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1392?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1393 mean in the context of cybersecurity?

[Assistant] CVE-2015-1393


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1393.

[Assistant] SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1393?

[Assistant] 20150128 [CVE-2015-1393] Photo Gallery (Wordpress Plugin) - SQL Injection in Version 1.2.8


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1393?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1394 mean in the context of cybersecurity?

[Assistant] CVE-2015-1394


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1394.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1394?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1394?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1395 mean in the context of cybersecurity?

[Assistant] CVE-2015-1395


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1395.

[Assistant] Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1395?

[Assistant] [oss-security] 20150127 Re: CVE Request: patch: directory traversal via file rename


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1395?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1396 mean in the context of cybersecurity?

[Assistant] CVE-2015-1396


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1396.

[Assistant] A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1396?

[Assistant] [oss-security] 20150127 Re: CVE Request: patch: CVE needed for incomplete fix for CVE-2015-1196?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1396?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1397 mean in the context of cybersecurity?

[Assistant] CVE-2015-1397


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1397.

[Assistant] SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1397?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1397?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1398 mean in the context of cybersecurity?

[Assistant] CVE-2015-1398


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1398.

[Assistant] Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1398?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1398?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1399 mean in the context of cybersecurity?

[Assistant] CVE-2015-1399


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1399.

[Assistant] PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1399?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1399?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1400 mean in the context of cybersecurity?

[Assistant] CVE-2015-1400


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1400.

[Assistant] SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1400?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1400?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1401 mean in the context of cybersecurity?

[Assistant] CVE-2015-1401


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1401.

[Assistant] Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1401?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1401?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1402 mean in the context of cybersecurity?

[Assistant] CVE-2015-1402


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1402.

[Assistant] Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1402?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1402?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1403 mean in the context of cybersecurity?

[Assistant] CVE-2015-1403


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1403.

[Assistant] SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1403?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1403?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1404 mean in the context of cybersecurity?

[Assistant] CVE-2015-1404


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1404.

[Assistant] Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1404?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1404?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1405 mean in the context of cybersecurity?

[Assistant] CVE-2015-1405


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1405.

[Assistant] SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1405?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1405?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1414 mean in the context of cybersecurity?

[Assistant] CVE-2015-1414


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1414.

[Assistant] Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1414?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1414?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1415 mean in the context of cybersecurity?

[Assistant] CVE-2015-1415


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1415.

[Assistant] The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1415?

[Assistant] 20150407 FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1415?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1416 mean in the context of cybersecurity?

[Assistant] CVE-2015-1416


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1416.

[Assistant] Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1416?

[Assistant]
[oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1)

[oss-security] 20150730 CVE-2015-1416: vulnerability in patch(1)

[oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1)

[oss-security] 20150802 Re: CVE-2015-1416: vulnerability in patch(1)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1416?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1417 mean in the context of cybersecurity?

[Assistant] CVE-2015-1417


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1417.

[Assistant] The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1417?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1417?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1418 mean in the context of cybersecurity?

[Assistant] CVE-2015-1418


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1418.

[Assistant] The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1418?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1418?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1419 mean in the context of cybersecurity?

[Assistant] CVE-2015-1419


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1419.

[Assistant] Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1419?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1419?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1420 mean in the context of cybersecurity?

[Assistant] CVE-2015-1420


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1420.

[Assistant] Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1420?

[Assistant]
[oss-security] 20150129 CVE-2015-1420 - Linux kernel fs/fhandle.c race condition

[linux-kernel] 20150128 [PATCH v2] vfs: read file_handle only once in handle_to_path


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1420?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1421 mean in the context of cybersecurity?

[Assistant] CVE-2015-1421


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1421.

[Assistant] Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1421?

[Assistant] [oss-security] 20150129 Re: CVE request -- Linux kernel - net: sctp: slab corruption from use after free on INIT collisions


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1421?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1422 mean in the context of cybersecurity?

[Assistant] CVE-2015-1422


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1422.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1422?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1422?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1423 mean in the context of cybersecurity?

[Assistant] CVE-2015-1423


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1423.

[Assistant] Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1423?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1423?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1424 mean in the context of cybersecurity?

[Assistant] CVE-2015-1424


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1424.

[Assistant] Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1424?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1424?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1425 mean in the context of cybersecurity?

[Assistant] CVE-2015-1425


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1425.

[Assistant] JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1425?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1425?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1426 mean in the context of cybersecurity?

[Assistant] CVE-2015-1426


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1426.

[Assistant] Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1426?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1426?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1427 mean in the context of cybersecurity?

[Assistant] CVE-2015-1427


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1427.

[Assistant] The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1427?

[Assistant] 20150211 Elasticsearch vulnerability CVE-2015-1427


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1427?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1428 mean in the context of cybersecurity?

[Assistant] CVE-2015-1428


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1428.

[Assistant] Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1428?

[Assistant] 20150202 Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2015-1428?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2015-1429 mean in the context of cybersecurity?

[Assistant] CVE-2015-1429


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2015-1429.

[Assistant] Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2015-1429?