CVE-2015-7338

The CVE refers to an SQL Injection in the AcyMailing Joomla Component prior to version 4.9.5, triggered by an exportgeolocorder parameter in a geolocation_longitude request to index.php. The vulnerability affects the component used within Joomla installations and can allow an attacker to manipula...

CVE-2015-7338

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

CVE-2015-7339

CVE-2015-7339 affects JCE Joomla Component (versions 2.5.0–2.5.2). The flaw lets an attacker upload arbitrary files by crafting an image file with a .php extension to the /com_jce/editor/libraries/classes/browser.php script, enabling potential code execution or server compromise as implied by arb...

CVE-2015-7340

JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action...

CVE-2015-7341

CVE-2015-7341 affects the JNews Joomla Component prior to 8.5.0. The issue enables arbitrary file upload via Subscribers or Templates, demonstrated by the .php5 extension, potentially allowing upload of PHP files. Affected product: JNews Joomla Component (versions before 8.5.0). Root cause: impro...

CVE-2015-7342

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field...

CVE-2015-7342

CVE-2015-7342 affects the JNews Joomla Component prior to 8.5.0. It allows SQL injection via multiple vectors: upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field. The available connected documents confirm the affected product and inputs, but do not provide...

CVE-2015-7343

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter...

CVE-2015-7343

The CVE-2015-7343 entry applies to the JNews Joomla Component prior to version 8.5.0, which is vulnerable to cross-site scripting (XSS) via the mailingsearch parameter. The connected documents confirm the vulnerable component and condition, but do not provide details on root cause, affected subco...

CVE-2015-7343

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter...

CVE-2015-7344

CVE-2015-7344 concerns the HikaShop Joomla Component prior to 2.6.0, where an XSS vulnerability exists via an injected payload in the affected component. The available connected sources confirm the vulnerability is an XSS issue but do not provide specific exploit details, affected versions beyond...

CVE-2015-7968

SAP NetWeaver Application Server is affected by CVE-2015-7968 due to the nwbc_ext2int component, which allows XXE-based local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI. The root cause is improper XML entity handling in nwbc_ext2int, enabling access to local files. The vulnerability...

Medium: freetype

Issue Overview: FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c. CVE-2015-9381 FreeType before 2.6.1 has a buffer over-read in skipcomment in psaux/psobjs.c because psparserskipPStoken is mishandled in an FTNewMemoryFace operation. CVE-2015-9382...

Apache ActiveMQ 5.11.1 Directory Traversal / Shell Upload Exploit

This Metasploit module exploits a directory traversal vulnerability CVE-2015-1830 in Apache ActiveMQ versions 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default...

GHSA-738M-F33V-QC2R SMTP Injection in PHPMailer

Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts. Patches Fixed in 5.2.14 in this commit. Workarounds Manually strip line breaks from email addresses before passing...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.5 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Improper access control

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by a vulnerability with the IPv6 networking support (CVE-2015-2922)

Summary The following vulnerability in IPv6 has been addressed by IBM Integrated Management Module II IMM2. Vulnerability Details CVEID: CVE-2015-2922 DESCRIPTION: Linux Kernel, built with the IPv6 networking supportCONFIGIPV6, is vulnerable to a denial of service, caused by the improper handling...

CVE-2015-1583

creationtimestamp| type| source ---|---|--- 2020-03-02 19:23:15+00:00| seen| https://t.me/cibsecurity/10216...

CVE-2015-1583

ATutor LCMS 2.2 is affected by CSRF in two admin-facing endpoints (mods/_core/users/admins/create.php and mods/_core/users/create_user.php). The root cause is cross-site request forgery that allows an authenticated admin context to create either another administrator (super admin) or a new instru...