Search criteria
11 vulnerabilities found for Nexus Dashboard Fabric Controller by Cisco
CERTFR-2025-AVI-0479
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | UCS Server Software versions 4.x antérieures à 4.1(3n) pour UCS B-Series et X-Series Servers en mode UCS Manager | ||
| Cisco | Nexus Dashboard Fabric Controller | Nexus Dashboard versions postérieures à 3.1 et antérieures à 3.2(2f) | ||
| Cisco | N/A | Intersight Server Firmware versions postérieures à 5.1 et antérieures à 5.2(2.240073) pour UCS X-Series Servers | ||
| Cisco | N/A | UCS Server Software versions 4.3 antérieures à 4.3(4c) pour UCS B-Series et X-Series Servers en mode UCS Manager | ||
| Cisco | N/A | IEC6400 Edge Compute Appliances sans la mise à jour IEC6400-HUU-4.2.3j.img | ||
| Cisco | N/A | Secure Malware Analytics Appliances versions antérieures à 2.19.4 | ||
| Cisco | Identity Services Engine | ISE versions 3.1 à 3.4 sans le patch de sécurité ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz | ||
| Cisco | N/A | UCS Server Software versions 4.2 antérieures à 4.2(3k) pour UCS B-Series et X-Series Servers en mode UCS Manager | ||
| Cisco | N/A | Secure Firewall Management Center Appliances sans le dernier patch de sécurité | ||
| Cisco | N/A | Intersight Server Firmware versions 5.0 antérieures à 5.0(4f) pour UCS X-Series Servers en mode Intersight Managed | ||
| Cisco | N/A | UCS Server Software versions 5.X antérieures à 5.2(2.240073) pour UCS B-Series Servers in Intersight Managed Mode | ||
| Cisco | N/A | UCS Server Software versions 4.X antérieures à 4.2(3i) pour UCS B-Series Servers in Intersight Managed Mode | ||
| Cisco | N/A | Secure Network Analytics Appliances sans le correctif de sécurité patch-common-SNA-FIRMWARE-20240305-v2-01.swu | ||
| Cisco | N/A | UCS Server Software versions 4.x antérieures à 4.2(2f), 4.2(3b) pour UCS C-Series et S-Series servers en mode standalone ou Intersight Managed Mode | ||
| Cisco | N/A | Secure Endpoint Private Cloud Appliances sans le dernier patch de sécurité | ||
| Cisco | N/A | Intersight Server Firmware versions 5.x antérieures à 5.2(2.240073) pour UCS B-Series Servers en mode Intersight Managed | ||
| Cisco | N/A | Cisco Telemetry Broker Appliance sans le microgiciel m6-tb2300-ctb-firmware-4.3-2.240009.iso | ||
| Cisco | N/A | UCS Server Software versions 4.x antérieures à 4.2(2c), 4.2(3b) pour UCS C-Series and S-Series Servers en mode UCS Manager |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "UCS Server Software versions 4.x ant\u00e9rieures \u00e0 4.1(3n) pour UCS B-Series et X-Series Servers en mode UCS Manager ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus Dashboard versions post\u00e9rieures \u00e0 3.1 et ant\u00e9rieures \u00e0 3.2(2f)",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Intersight Server Firmware versions post\u00e9rieures \u00e0 5.1 et ant\u00e9rieures \u00e0 5.2(2.240073) pour UCS X-Series Servers",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 4.3 ant\u00e9rieures \u00e0 4.3(4c) pour UCS B-Series et X-Series Servers en mode UCS Manager ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IEC6400 Edge Compute Appliances sans la mise \u00e0 jour IEC6400-HUU-4.2.3j.img ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Malware Analytics Appliances versions ant\u00e9rieures \u00e0 2.19.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ISE versions 3.1 \u00e0 3.4 sans le patch de s\u00e9curit\u00e9 ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz",
"product": {
"name": "Identity Services Engine",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 4.2 ant\u00e9rieures \u00e0 4.2(3k) pour UCS B-Series et X-Series Servers en mode UCS Manager ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Firewall Management Center Appliances sans le dernier patch de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Intersight Server Firmware versions 5.0 ant\u00e9rieures \u00e0 5.0(4f) pour UCS X-Series Servers en mode Intersight Managed ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 5.X ant\u00e9rieures \u00e0 5.2(2.240073) pour UCS B-Series Servers in Intersight Managed Mode",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 4.X ant\u00e9rieures \u00e0 4.2(3i) pour UCS B-Series Servers in Intersight Managed Mode",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Network Analytics Appliances sans le correctif de s\u00e9curit\u00e9 patch-common-SNA-FIRMWARE-20240305-v2-01.swu ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 4.x ant\u00e9rieures \u00e0 4.2(2f), 4.2(3b) pour UCS C-Series et S-Series servers en mode standalone ou Intersight Managed Mode ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Secure Endpoint Private Cloud Appliances sans le dernier patch de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Intersight Server Firmware versions 5.x ant\u00e9rieures \u00e0 5.2(2.240073) pour UCS B-Series Servers en mode Intersight Managed ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Telemetry Broker Appliance sans le microgiciel m6-tb2300-ctb-firmware-4.3-2.240009.iso",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS Server Software versions 4.x ant\u00e9rieures \u00e0 4.2(2c), 4.2(3b) pour UCS C-Series and S-Series Servers en mode UCS Manager ",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20261",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20261"
},
{
"name": "CVE-2025-20163",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20163"
},
{
"name": "CVE-2025-20286",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20286"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0479",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2025-06-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ucs-ssh-priv-esc-2mZDtdjM",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-ssh-priv-esc-2mZDtdjM"
},
{
"published_at": "2025-06-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndfc-shkv-snQJtjrp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-shkv-snQJtjrp"
},
{
"published_at": "2025-06-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ise-aws-static-cred-FPMjUcm7",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7"
}
]
}
CERTFR-2024-AVI-0950
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Enterprise Chat and Email (ECE) | Enterprise Chat and Email versions antérieures à 12.5(1) ES9 | ||
| Cisco | Unified Industrial Wireless Software | Unified Industrial Wireless versions antérieures à 17.15.1 | ||
| Cisco | Nexus Dashboard Fabric Controller | Nexus Dashboard Fabric Controller versions antérieures à 12.2.2 | ||
| Cisco | Enterprise Chat and Email (ECE) | Enterprise Chat and Email versions 12.6 antérieures à 12.6(1) ES9 ET3 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Enterprise Chat and Email versions ant\u00e9rieures \u00e0 12.5(1) ES9",
"product": {
"name": "Enterprise Chat and Email (ECE)",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Unified Industrial Wireless versions ant\u00e9rieures \u00e0 17.15.1",
"product": {
"name": "Unified Industrial Wireless Software",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus Dashboard Fabric Controller versions ant\u00e9rieures \u00e0 12.2.2",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Enterprise Chat and Email versions 12.6 ant\u00e9rieures \u00e0 12.6(1) ES9 ET3",
"product": {
"name": "Enterprise Chat and Email (ECE)",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20536",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20536"
},
{
"name": "CVE-2024-20418",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20418"
},
{
"name": "CVE-2024-20484",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20484"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0950",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2024-11-06",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ece-dos-Oqb9uFEv",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-Oqb9uFEv"
},
{
"published_at": "2024-11-06",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndfc-sqli-CyPPAxrL",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-sqli-CyPPAxrL"
},
{
"published_at": "2024-11-06",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-backhaul-ap-cmdinj-R7E28Ecs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-backhaul-ap-cmdinj-R7E28Ecs"
}
]
}
CERTFR-2024-AVI-0833
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Les périphériques Small Business RV340, RV340W, RV345, et RV345P Dual WAN Gigabit VPN ne sont plus supportés et ne seront pas mis à jour par Cisco.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Meraki MX | Meraki MX et Z versions postérieures à 16.2 et antérieures à 18.211.2 | ||
| Cisco | Nexus Dashboard Fabric Controller | Nexus Dashboard Fabric Controller versions 12.0 antérieures à 12.2.2 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Meraki MX et Z versions post\u00e9rieures \u00e0 16.2 et ant\u00e9rieures \u00e0 18.211.2",
"product": {
"name": "Meraki MX",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus Dashboard Fabric Controller versions 12.0 ant\u00e9rieures \u00e0 12.2.2",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "Les p\u00e9riph\u00e9riques Small Business RV340, RV340W, RV345, et RV345P Dual WAN Gigabit VPN ne sont plus support\u00e9s et ne seront pas mis \u00e0 jour par Cisco.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20501",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20501"
},
{
"name": "CVE-2024-20499",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20499"
},
{
"name": "CVE-2024-20449",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20449"
},
{
"name": "CVE-2024-20393",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20393"
},
{
"name": "CVE-2024-20500",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20500"
},
{
"name": "CVE-2024-20432",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20432"
},
{
"name": "CVE-2024-20502",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20502"
},
{
"name": "CVE-2024-20513",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20513"
},
{
"name": "CVE-2024-20498",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20498"
},
{
"name": "CVE-2024-20470",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20470"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0833",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2024-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndfc-ptrce-BUSHLbp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp"
},
{
"published_at": "2024-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndfc-cmdinj-UvYZrKfr",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cmdinj-UvYZrKfr"
},
{
"published_at": "2024-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-meraki-mx-vpn-dos-QTRHzG2",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-QTRHzG2"
},
{
"published_at": "2024-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv34x-privesc-rce-qE33TCms",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms"
}
]
}
CERTFR-2024-AVI-0270
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Cisco Nexus Dashboard Fabric Controller. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Nexus Dashboard Fabric Controller | Nexus Dashboard Fabric Controller versions postérieures à 12.1.3 et antérieures à 12.2.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Nexus Dashboard Fabric Controller versions post\u00e9rieures \u00e0 12.1.3 et ant\u00e9rieures \u00e0 12.2.1",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-20348",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20348"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0270",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Nexus Dashboard Fabric\nController. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco Nexus Dashboard Fabric Controller",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndfc-dir-trav-SSn3AYDw du 03 avril 2024",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-dir-trav-SSn3AYDw"
}
]
}
CERTFR-2022-AVI-315
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Cisco Nexus Dashboard Fabric Controller, anciennement dénommé Data Center Network Manager (DCNM). Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Nexus Dashboard Fabric Controller | Cisco Nexus Dashboard Fabric Controller versions 11.x antérieures à 11.5(4) | ||
| Cisco | Nexus Dashboard Fabric Controller | Cisco Nexus Dashboard Fabric Controller versions 12.x antérieures à 12.0(0.1063) et 12.0(0) |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Nexus Dashboard Fabric Controller versions 11.x ant\u00e9rieures \u00e0 11.5(4)",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Nexus Dashboard Fabric Controller versions 12.x ant\u00e9rieures \u00e0 12.0(0.1063) et 12.0(0)",
"product": {
"name": "Nexus Dashboard Fabric Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2015-3269",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3269"
},
{
"name": "CVE-2017-5641",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5641"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-315",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-06T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco \u003cspan\nclass=\"qtr-padding\"\u003eNexus Dashboard Fabric Controller\u003c/span\u003e,\nanciennement d\u00e9nomm\u00e9 Data Center Network Manager (DCNM). Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco Data Center Network Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 ZDI ZDI-CAN-14806 du 11 mars 2022",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-CAN-14806/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco CSCvz62623 du 01 avril 2022",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz62623"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco CSCvz62628 du 01 avril 2022",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz62628"
}
]
}
VAR-201508-0177
Vulnerability from variot - Updated: 2024-04-19 22:40Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the fmserver user. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. However this expanded information is not automatically transferred back to the client, but could be made available by the application. ------------------------------------------------------------------------ VMware Security Advisory
Advisory ID: VMSA-2015-0008 Synopsis: VMware product updates address information disclosure issue
Issue date: 2015-11-18 Updated on: 2015-11-18 CVE number: CVE-2015-3269
- Summary
VMware product updates address information disclosure issue.
- Relevant Releases
VMware vCenter Server 5.5 prior to version 5.5 update 3 VMware vCenter Server 5.1 prior to version 5.1 update u3b VMware vCenter Server 5.0 prior to version 5.0 update u3e
vCloud Director 5.6 prior to version 5.6.4 vCloud Director 5.5 prior to version 5.5.3
VMware Horizon View 6.0 prior to version 6.1 VMware Horizon View 5.0 prior to version 5.3.4
- Problem Description
a. vCenter Server, vCloud Director, Horizon View information disclosure issue. A specially crafted XML request sent to the server could lead to unintended information be disclosed.
VMware would like to thank Matthias Kaiser of Code White GmbH for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-3269 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 6.0 any not affected
vCenter Server 5.5 any 5.5 update 3
vCenter Server 5.1 any 5.1 update u3b
vCenter Server 5.0 any 5.5 update u3e
vCloud Director 5.6 any 5.6.4
vCloud Director 5.5 any 5.5.3
Horizon View 6.0 any 6.1
Horizon View 5.3 any 5.3.4
- Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
vCenter Server
Downloads and Documentation: https://www.vmware.com/go/download-vsphere
vCloud Director For Service Providers
Downloads and Documentation: https://www.vmware.com/support/pubs/vcd_pubs.html
Horizon View 6.1, 5.3.4:
Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productId=492 https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&productId=396
- References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269
- Change log
2015-11-18 VMSA-2015-0008 Initial security advisory
- Contact
E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org
E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories http://kb.vmware.com/kb/2078735
VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html
Twitter https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05026202
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c05026202 Version: 2
HPSBGN03550 rev.2 - HP Operations Manager i and BSM using Apache Flex BlazeDS, Remote Disclosure of Information
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2016-03-03 Last Updated: 2016-03-03
Potential Security Impact: Remote Disclosure of Information
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A security vulnerability in Apache Flex BlazeDS was addressed by HP Operations Manager i (OMi) and Business Service Manager (BSM).
Note : OMi v10.10 is NOT affected by this vulnerability.
References:
CVE-2015-3269 SSRT102232
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
Operations Manager i v10.0, v10.01 Business Service Manager v9.x to v9.26
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2015-3269 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
The Hewlett Packard Enterprise Company thanks Nicholas Miles from Tenable Network Security for reporting this issue to security-alert@hpe.com
RESOLUTION
HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of Operations Manager i and Business Service Manager:
For OMi 10.0 update to OMi 10.0 IP3 or above. The OMi 10.0 IP3 patches can be found here:
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00122?lang=en&cc=us&hpappid=202392_OSP_PRO_ HPE
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00123?lang=en&cc=us&hpappid=202392_OSP_PRO_HP E
For OMi 10.01 update to OMi 10.01 IP2 or above. The OMi 10.01 IP2 patches can be found here:
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00120
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00121
OMi 10.10 is NOT affected by this vulnerability.
For BSM 9.x to 9.25, update to BSM 9.25 IP2 or above.
For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/BAC_00899
For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/BAC_00896
For BSM 9.26 please contact HPE Technical Support.
HISTORY Version:1 (rev.1) - 3 March 2016 Initial release Version:2 (rev.2) - 3 March 2016 Added acknowledgment section
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBAgAGBQJW2GZoAAoJEGIGBBYqRO9/g7wIAIuGN+IoM69sf1dzu0wROFfj fDKMymKIsUz975nC1VoPm+70FiBRNKwuL73uqA7Gkrhnv1ldxeBjsX058FR3q5ZE mhlhfp86BMKJMtuWI3nTVo25gQM4PVaB6GuS52PrROhwcNRKnGy6K1OlYPEtFXiy OC6YNBwBBbvookB6bPkziPzvdc85zTU8Pc7YDZQoO14vw/k1PDBaFSHs7QnLlrAw 2cZADbYL9QIDWjIO/QVHo8iwYkjpxRmBzK6qXg/Ys1vij6/RYLqMtk5fxxMRlkfS 0oiFiUS8zVf+QASHRAuj4KXeCOCi66UEAgewkDa15GyByubl8WQRg7ovw1fHGUA= =4Dvo -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201508-0177",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "3.0"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "4.7"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.9,
"vendor": "adobe",
"version": "4.5"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "4.6"
},
{
"model": "business service management",
"scope": "lte",
"trust": 1.0,
"vendor": "hp",
"version": "9.26"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "adobe",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apache",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "atlassian",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "vmware",
"version": null
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.0.354170"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2"
},
{
"model": "jp1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "jp1/automatic operation",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner 1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5.1.354169"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( domestic version )"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "2 - manager"
},
{
"model": "job management partner 1/it desktop management - manager",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "3.0.x"
},
{
"model": "compute systems manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software ( overseas edition )"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7.0.354169"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.7"
},
{
"model": "automation director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "job management partner",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "1/automatic operation"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "4.6.2.354169"
},
{
"model": "livecycle data services",
"scope": "lt",
"trust": 0.8,
"vendor": "adobe",
"version": "4.5"
},
{
"model": "nexus dashboard fabric controller",
"scope": null,
"trust": 0.7,
"vendor": "cisco",
"version": null
},
{
"model": "vcloud director",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcloud director",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.6"
},
{
"model": "vcenter server update1",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.52"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.13"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.11"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.1"
},
{
"model": "vcenter server update2",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update u3b",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update 3c",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server update",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.01"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3.1"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.0"
},
{
"model": "horizon view",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3"
},
{
"model": "operations manager i",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.01"
},
{
"model": "operations manager i",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.00"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.26"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.20"
},
{
"model": "business service manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.10"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-02"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-01"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-02"
},
{
"model": "jp1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-50"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-10-01"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-03"
},
{
"model": "job management partner 1/automatic operation",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "10-00-02"
},
{
"model": "flex blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "4.7"
},
{
"model": "flex blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "4.6.0.23207"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.6.2"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "115"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "114"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "113"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "112"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "111"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.08"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.04"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.03"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.02"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.01"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "109"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "106"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "105"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1016"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1015"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1014"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1013"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1012"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1011"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1010"
},
{
"model": "coldfusion update",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "101"
},
{
"model": "coldfusion",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10"
},
{
"model": "vcloud director",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.6.4"
},
{
"model": "vcloud director",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.5.3"
},
{
"model": "vcenter server update",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.53"
},
{
"model": "vcenter server update u3b",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.1"
},
{
"model": "vcenter server update u3e",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "horizon view",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "5.3.4"
},
{
"model": "horizon view",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": "6.1"
},
{
"model": "jp1/automatic operation",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "11-00-01"
},
{
"model": "flex blazeds",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "4.7.1"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "6.2.354169"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "4.7.0.3541694"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "4.5.1.354169"
},
{
"model": "livecycle data services",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "3.0.0.354170"
},
{
"model": "coldfusion update",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "116"
},
{
"model": "coldfusion update",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "1017"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:hp:business_service_management:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.26",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:4.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:4.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:4.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kpc",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 1.3
},
"cve": "CVE-2015-3269",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2015-3269",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2015-3269",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-3269",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2015-3269",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201508-438",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the fmserver user. \nAttackers can exploit this issue to obtain sensitive information that may lead to further attacks. \nHowever this expanded information is not automatically transferred back to\nthe client, but could be made available by the application. ------------------------------------------------------------------------\n VMware Security Advisory\n\nAdvisory ID: VMSA-2015-0008\nSynopsis: VMware product updates address information disclosure\n issue\n\nIssue date: 2015-11-18\nUpdated on: 2015-11-18\nCVE number: CVE-2015-3269\n------------------------------------------------------------------------\n\n1. Summary\n\n VMware product updates address information disclosure issue. \n\n\n2. Relevant Releases\n\n VMware vCenter Server 5.5 prior to version 5.5 update 3\n VMware vCenter Server 5.1 prior to version 5.1 update u3b\n VMware vCenter Server 5.0 prior to version 5.0 update u3e\n\n vCloud Director 5.6 prior to version 5.6.4\n vCloud Director 5.5 prior to version 5.5.3\n\n VMware Horizon View 6.0 prior to version 6.1\n VMware Horizon View 5.0 prior to version 5.3.4\n\n\n\n3. Problem Description\n\n a. vCenter Server, vCloud Director, Horizon View information\n disclosure issue. A specially\n crafted XML request sent to the server could lead to unintended\n information be disclosed. \n\n VMware would like to thank Matthias Kaiser of Code White GmbH for\n reporting this issue to us. \n\n The Common Vulnerabilities and Exposures project (cve.mitre.org)\n has assigned the identifier CVE-2015-3269 to this issue. \n\n Column 4 of the following table lists the action required to\n remediate the vulnerability in each release, if a solution is\n available. \n\n VMware Product\t Running Replace with/\n Product Version\t on Apply Patch\n =============\t=======\t ======= =================\n vCenter Server 6.0 any not affected\n vCenter Server 5.5 any 5.5 update 3\n vCenter Server 5.1 any 5.1 update u3b\n vCenter Server 5.0 any 5.5 update u3e\n\n vCloud Director 5.6 any 5.6.4\n vCloud Director 5.5 any 5.5.3\n\n Horizon View 6.0 any 6.1\n Horizon View 5.3 any 5.3.4\n\n\n4. Solution\n\n Please review the patch/release notes for your product and version\n and verify the checksum of your downloaded file. \n\n\n vCenter Server\n --------------------------------\n Downloads and Documentation:\n https://www.vmware.com/go/download-vsphere\n\n vCloud Director For Service Providers\n --------------------------------\n Downloads and Documentation:\n https://www.vmware.com/support/pubs/vcd_pubs.html\n\n Horizon View 6.1, 5.3.4:\n --------------------------------\n Downloads:\n https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA\u0026productId=492\n https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER\u0026productId=396\n\n\n5. References\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269\n\n------------------------------------------------------------------------\n\n6. Change log\n\n 2015-11-18 VMSA-2015-0008\n Initial security advisory\n\n------------------------------------------------------------------------\n\n7. Contact\n\n E-mail list for product security notifications and announcements:\n http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\n This Security Advisory is posted to the following lists:\n\n security-announce at lists.vmware.com\n bugtraq at securityfocus.com\n fulldisclosure at seclists.org\n\n E-mail: security at vmware.com\n PGP key at: http://kb.vmware.com/kb/1055\n\n VMware Security Advisories\n http://www.vmware.com/security/advisories\n\n Consolidated list of VMware Security Advisories\n http://kb.vmware.com/kb/2078735\n\n VMware Security Response Policy\n https://www.vmware.com/support/policies/security_response.html\n\n VMware Lifecycle Support Phases\n https://www.vmware.com/support/policies/lifecycle.html\n\n Twitter\n https://twitter.com/VMwareSRC\n\n Copyright 2015 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n\na-c05026202\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05026202\nVersion: 2\n\nHPSBGN03550 rev.2 - HP Operations Manager i and BSM using Apache Flex\nBlazeDS, Remote Disclosure of Information\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-03-03\nLast Updated: 2016-03-03\n\nPotential Security Impact: Remote Disclosure of Information\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA security vulnerability in Apache Flex BlazeDS was addressed by HP\nOperations Manager i (OMi) and Business Service Manager (BSM). \n\nNote : OMi v10.10 is NOT affected by this vulnerability. \n\nReferences:\n\nCVE-2015-3269\nSSRT102232\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\nOperations Manager i v10.0, v10.01\nBusiness Service Manager v9.x to v9.26\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2015-3269 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nThe Hewlett Packard Enterprise Company thanks Nicholas Miles from Tenable\nNetwork Security for reporting this issue to security-alert@hpe.com\n\nRESOLUTION\n\nHPE has made the following mitigation information available to resolve the\nvulnerability for the impacted versions of Operations Manager i and Business\nService Manager:\n\nFor OMi 10.0 update to OMi 10.0 IP3 or above. \nThe OMi 10.0 IP3 patches can be found here:\n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/OMI_00122?lang=en\u0026cc=us\u0026hpappid=202392_OSP_PRO_\nHPE\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/OMI_00123?lang=en\u0026cc=us\u0026hpappid=202392_OSP_PRO_HP\nE\n\nFor OMi 10.01 update to OMi 10.01 IP2 or above. \nThe OMi 10.01 IP2 patches can be found here:\n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/OMI_00120\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/OMI_00121\n\nOMi 10.10 is NOT affected by this vulnerability. \n\nFor BSM 9.x to 9.25, update to BSM 9.25 IP2 or above. \n\nFor Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu\nlt/-/facetsearch/document/LID/BAC_00899\n\nFor Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result\n/-/facetsearch/document/LID/BAC_00896\n\nFor BSM 9.26 please contact HPE Technical Support. \n\nHISTORY\nVersion:1 (rev.1) - 3 March 2016 Initial release\nVersion:2 (rev.2) - 3 March 2016 Added acknowledgment section\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability with any HPE supported\nproduct, send Email to: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBAgAGBQJW2GZoAAoJEGIGBBYqRO9/g7wIAIuGN+IoM69sf1dzu0wROFfj\nfDKMymKIsUz975nC1VoPm+70FiBRNKwuL73uqA7Gkrhnv1ldxeBjsX058FR3q5ZE\nmhlhfp86BMKJMtuWI3nTVo25gQM4PVaB6GuS52PrROhwcNRKnGy6K1OlYPEtFXiy\nOC6YNBwBBbvookB6bPkziPzvdc85zTU8Pc7YDZQoO14vw/k1PDBaFSHs7QnLlrAw\n2cZADbYL9QIDWjIO/QVHo8iwYkjpxRmBzK6qXg/Ys1vij6/RYLqMtk5fxxMRlkfS\n0oiFiUS8zVf+QASHRAuj4KXeCOCi66UEAgewkDa15GyByubl8WQRg7ovw1fHGUA=\n=4Dvo\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-3269"
},
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
}
],
"trust": 3.51
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-3269",
"trust": 3.7
},
{
"db": "ZDI",
"id": "ZDI-22-508",
"trust": 2.3
},
{
"db": "BID",
"id": "76394",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1033337",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#307983",
"trust": 1.1
},
{
"db": "CERT/CC",
"id": "VU#279472",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-15192",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "46622",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438",
"trust": 0.6
},
{
"db": "HITACHI",
"id": "HS16-005",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "133250",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "136084",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"id": "VAR-201508-0177",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2024-04-19T22:40:08.722000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB15-20",
"trust": 0.8,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html"
},
{
"title": "APSB15-20",
"trust": 0.8,
"url": "https://helpx.adobe.com/jp/security/products/livecycleds/apsb15-20.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html"
},
{
"title": "HS15-028",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs15-028/index.html"
},
{
"title": "HS16-009",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs16-009/index.html"
},
{
"title": "HS16-005",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs16-005/index.html"
},
{
"title": "HS15-028",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs15-028/index.html"
},
{
"title": "LCDS_4.6.2",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57450"
},
{
"title": "LCDS_4.5.1",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57449"
},
{
"title": "LCDS_3.1.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57448"
},
{
"title": "LCDS_3.0.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57447"
},
{
"title": "LCDS_4.7.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=57451"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://www.zerodayinitiative.com/advisories/zdi-22-508/"
},
{
"trust": 1.9,
"url": "https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1033337"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/archive/1/536266/100/0/threaded"
},
{
"trust": 1.6,
"url": "http://www.vmware.com/security/advisories/vmsa-2015-0008.html"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=145706712500978\u0026w=2"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05026202"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/76394"
},
{
"trust": 1.6,
"url": "https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3269"
},
{
"trust": 0.8,
"url": "http://codewhitesec.blogspot.com/2017/04/amf.html"
},
{
"trust": 0.8,
"url": "http://openjdk.java.net/jeps/290"
},
{
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/279472"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/go/amfspec"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/913.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/611.html"
},
{
"trust": 0.8,
"url": "https://flex.apache.org/download-blazeds.html"
},
{
"trust": 0.8,
"url": "https://www.vmware.com/security/advisories/vmsa-2017-0007.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3269"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/archive/1/archive/1/536266/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/46622"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/devnet/livecycle/dataservices.html"
},
{
"trust": 0.3,
"url": "http://seclists.org/oss-sec/2015/q3/394"
},
{
"trust": 0.3,
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb15-21.html"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05026202"
},
{
"trust": 0.3,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html"
},
{
"trust": 0.3,
"url": "http://www.vmware.com/security/advisories/vmsa-2015-0008"
},
{
"trust": 0.3,
"url": "http://www.kb.cert.org/vuls/id/307983"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3269"
},
{
"trust": 0.1,
"url": "https://www.owasp.org/index.php/xml_external_entity_(xxe)_processing"
},
{
"trust": 0.1,
"url": "https://twitter.com/vmwaresrc"
},
{
"trust": 0.1,
"url": "https://my.vmware.com/web/vmware/details?downloadgroup=view-534-premier\u0026productid=396"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/policies/lifecycle.html"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/1055"
},
{
"trust": 0.1,
"url": "http://www.vmware.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/go/download-vsphere"
},
{
"trust": 0.1,
"url": "http://kb.vmware.com/kb/2078735"
},
{
"trust": 0.1,
"url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/policies/security_response.html"
},
{
"trust": 0.1,
"url": "https://www.vmware.com/support/pubs/vcd_pubs.html"
},
{
"trust": 0.1,
"url": "https://my.vmware.com/web/vmware/details?downloadgroup=view-610-ga\u0026productid=492"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hp.com/group/softwaresupport/search-resu"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/security_bulletin_archive"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hp.com/group/softwaresupport/search-result"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#307983"
},
{
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"db": "BID",
"id": "76394"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"db": "PACKETSTORM",
"id": "133250"
},
{
"db": "PACKETSTORM",
"id": "134439"
},
{
"db": "PACKETSTORM",
"id": "136084"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-04T00:00:00",
"db": "CERT/CC",
"id": "VU#307983"
},
{
"date": "2022-03-11T00:00:00",
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"date": "2015-08-18T00:00:00",
"db": "BID",
"id": "76394"
},
{
"date": "2015-08-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"date": "2015-08-22T13:33:33",
"db": "PACKETSTORM",
"id": "133250"
},
{
"date": "2015-11-19T14:15:30",
"db": "PACKETSTORM",
"id": "134439"
},
{
"date": "2016-03-04T16:03:09",
"db": "PACKETSTORM",
"id": "136084"
},
{
"date": "2015-08-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"date": "2015-08-25T01:59:00.087000",
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-14T00:00:00",
"db": "CERT/CC",
"id": "VU#307983"
},
{
"date": "2022-03-11T00:00:00",
"db": "ZDI",
"id": "ZDI-22-508"
},
{
"date": "2017-04-11T01:03:00",
"db": "BID",
"id": "76394"
},
{
"date": "2016-03-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004431"
},
{
"date": "2022-03-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-438"
},
{
"date": "2022-03-11T17:15:08.207000",
"db": "NVD",
"id": "CVE-2015-3269"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references",
"sources": [
{
"db": "CERT/CC",
"id": "VU#307983"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-438"
}
],
"trust": 0.6
}
}