35966 matches found
CVE-2015-9538
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection...
CVE-2015-9537
The CVE-2015-9537 entry concerns the WordPress NextGEN Gallery plugin prior to version 2.1.10, which contains multiple XSS vulnerabilities. The affected component is the NextGEN Gallery WordPress plugin; the root cause is insufficient sanitization/validation of user-supplied input in several fiel...
CVE-2015-9538
The CVE-2015-9538 entry applies to the WordPress NextGEN Gallery plugin prior to version 2.1.15. The flaw is a directory traversal vulnerability in path selection ("../"), caused by insufficient filtering of path components, which could allow access to locations outside a restricted directory. Af...
CVE-2015-9538
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection...
CVE-2015-9539
The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fscontactform1welcome XSS...
CVE-2015-9539
The CVE-2015-9539 entry concerns the WordPress plugin Fast Secure Contact Form. Affects versions prior to 4.0.38, where the fs_contact_form1[welcome] parameter is vulnerable to cross-site scripting (XSS). Root cause is insufficient input validation/escaping in the form handling, enabling attacker...
CVE-2015-7831
In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used...
CVE-2015-6495
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles...
CVE-2015-4457
CVE-2015-4457 describes multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI prior to version 5.4.3. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The available references consistently state XSS as the impact,...
CVE-2015-4457
Multiple cross-site scripting XSS vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors...
CVE-2015-6495
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles...
CVE-2015-6495
This CVE concerns Cloudera Manager prior to version 5.4.6, where the Diagnostic Support Bundles could disclose sensitive information. Multiple sources (NVD, Red Hat, CNVD, CVE lists) confirm an information-disclosure vulnerability affected Cloudera Manager before 5.4.6. Impact centers on confiden...
CVE-2015-7831
CVE-2015-7831 affects Cloudera Hue with privilege escalation for a read-only user when CDH 5.x before 5.4.9 is used. The NVD entry documents the vulnerability with CVSS 2.0/3.1 scores (base 6.5 and 8.8, respectively) and an attack path described as network-based with low attack complexity and no ...
DEBIAN-CVE-2015-1396
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196...
CVE-2015-1396
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196...
CVE-2015-1396
GNU patch before 2.7.4 is vulnerable to a directory-traversal via a symlink attack in a patch file, allowing remote write of arbitrary files. Root cause: incomplete fix for CVE-2015-1196. Affected: GNU patch (up to 2.7.3). Remediation: upgrade to 2.7.4 or later; no further details provided in the...
CVE-2015-7810
libbluray MountManager class has a time-of-check time-of-use TOCTOU race when expanding JAR files...
CVE-2015-7810
CVE-2015-7810 affects the libbluray MountManager class, where a time-of-check time-of-use (TOCTOU) race can occur during the expansion of JAR files. The available connected material confirms the vulnerable component (MountManager in libbluray) and the underlying issue (TOCTOU race condition) but ...
CVE-2015-1780
CVE-2015-1780 affects oVirt (notably ovirt-engine) where users holding MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center. The connected Nessus entries corroborate an unpatched exposure for this vulnerability, but the provided documents do not include patch versi...