CVE-2015-6591

The CVE-2015-6591 entry concerns Free Reprintables ArticleFR 3.0.7 and earlier. It affects the web application path application/templates/amelia/loadjs.php, where the s parameter is used to read files via file_get_contents without proper validation, enabling local arbitrary file read by a non-aut...

CVE-2015-1811

Jenkins XXE: XML External Entity handling flaw in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows reading arbitrary XML files via crafted XML documents. Root cause: improper XML processing. Affected products/versions are Jenkins core prior to 1.600 and LTS prior to 1.596.1. Remediati...

CVE-2015-1811

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document...

CVE-2015-1809

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query...

CVE-2015-1809

CVE-2015-1809 describes an XML External Entity (XXE) vulnerability in CloudBees Jenkins prior to 1.600 and in LTS releases prior to 1.596.1. The vulnerability arises from Jenkins' XPath/XML handling, allowing a remote attacker with read access to read arbitrary XML files on the Jenkins server. Af...

CVE-2015-6497

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

CVE-2015-5230

The DNS packet parsing/generation code in PowerDNS aka pdns Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service crash via crafted query packets...

CVE-2015-5071

CVE-2015-5071 affects BMC Remedy AR System: AR System Mid Tier prior to 9.0 SP1 in AR Reporting can allow remote authenticated users to navigate to arbitrary files via the __report parameter of the BIRT Viewer servlet. The vulnerability has been confirmed in BMC Remedy AR 8.1 and 9.0 (per errata)...

CVE-2015-5072

The CVE-2015-5072 entry concerns BMC Remedy AR System Server’s BIRT Engine Mid Tier prior to 9.0 SP1, where the BIRT Engine servlet could be exploited by remote authenticated users to navigate to arbitrary local files via the __imageid parameter. The issue is caused by a file inclusion/control pa...

CVE-2015-6497

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

CVE-2015-6497

The CVE-2015-6497 flaw affects Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, where unvalidated data passed in the SOAP API’s productData parameter to index.php/api/v2_soap enables remote authenticated attackers to execute arbitrary PHP code. The root c...

CVE-2015-5230

CVE-2015-5230 affects PowerDNS Authoritative Server 3.4.x up to before 3.4.6. The DNS packet parsing/generation code can crash the server on crafted query packets, enabling a remote DoS. Upgrading to 3.4.6 or later (per Fedora advisories and vendor fix) is the indicated remediation. No exploitati...

CVE-2015-5952

CVE-2015-5952 affects Thomson Reuters FATCA; all versions below 5.2 are vulnerable to Local File Inclusion via the item parameter, enabling inclusion of local files and potential command execution. Exploitation details appear in zdt/packetstorm references; mitigation implied by upgrading to v5.2 ...

CVE-2015-5484

Cross-site scripting XSS vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post...

CVE-2015-5466

CVE-2015-5466 affects Silicon Integrated Systems’ XGI VGA Display Manager (XGI VGA Display Manager) version 6.14.10.1090 on Windows XP SP3. A vulnerability in the xrvkp module allows an attacker to perform an arbitrary write (write-what-where) via IOCTL 0x96002404, enabling privilege escalation b...

CVE-2015-5484

Cross-site scripting XSS vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post...

CVE-2015-5484

CVE-2015-5484 is a stored XSS vulnerability in the WordPress Plotly plugin prior to 1.0.3. It allows remote authenticated users to inject arbitrary script/HTML into posts, potentially affecting other site users. Affected component: Plotly WordPress plugin; vulnerability path: XSS via post content...

CVE-2015-7874

CVE-2015-7874 affects KiTTY Portable 0.65.0.2p and earlier: a buffer overflow in the chat server triggered by a long nickname can allow a remote attacker to execute arbitrary code. NVD CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no privileges, no user interaction, and high imp...

CVE-2015-7874

Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname...

CVE-2015-7556

DeleGate 9.9.13 is affected by a local privilege escalation vulnerability. The issue arises from setuid root binaries (notably dgcpnod) that can be abused by local users to gain root privileges. Exploitation details are documented in multiple public references (e.g., Vapidlabs advisory, 1337DAY e...