CVE-2015-9259

CVE-2015-9259 affects Docker Notary prior to 0.1. The vulnerability is in the checkRoot function in gotuf/client/client.go, which does not verify the expiry of root.json files as documented. As a result, even if a new root.json is deployed after a key is compromised, an attacker can craft update ...

CVE-2015-9259

In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json fi...

CVE-2015-9258

CVE-2015-9258 concerns Docker Notary prior to 0.1. The vulnerability lies in gotuf/signed/verify.go where the Signature Algorithm Not Matched to Key allows an attacker who controls the signature-algorithm field to forge a signature by forcing RSA-PSS key data to be interpreted as Ed25519 elliptic...

CVE-2015-2020

The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2003

The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2001

The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2002

The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-4953

IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryption protocol. IBM X-Force ID: 105197...

CVE-2015-4952

The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196...

CVE-2015-2002

The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2003

Summary: CVE-2015-2003 affects the PJSIP PJSUA2 SDK for Android prior to SVN Changeset 51322. The underlying issue is in a Serializable class’s finalize method, which improperly passes an attacker-controlled pointer to a native function, enabling arbitrary code execution. Documents consistently d...

CVE-2015-2000

CVE-2015-2000 affects the Jumio SDK for Android prior to 1.5.0. The issue arises from a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function, allowing arbitrary code execution. Affected product: Jumio SDK for Android (pre-1.5.0). Impac...

CVE-2015-2001

The CVE-2015-2001 entry concerns the MetaIO SDK for Android (before 6.0.2.1). The vulnerability arises in a Serializable class’s finalize method that improperly passes an attacker-controlled pointer to a native function, enabling arbitrary code execution. Connected documents corroborate the vulne...

CVE-2015-2020

The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2009

CVE-2015-2009 concerns IBM QRadar SIEM: a CSRF in the xmlrpc.cgi service allows an attacker to hijack user authentication for requests that insert XSS sequences. Affected: QRadar 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4. Impact described as authentication hijack via C...

CVE-2015-4953

CVE-2015-4953 concerns IBM BigFix Remote Control prior to Interim Fix pack 9.1.2-TIV-IBRC912-IF0001. The weakness in its encryption protocol can enable a man-in-the-middle attacker to decrypt traffic. Affected product/component: IBM BigFix Remote Control; root cause is encryption protocol weaknes...

CVE-2015-2003

The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function...

CVE-2015-2009

Cross-site request forgery CSRF vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to...

CVE-2015-4952

The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196...

CVE-2015-2004

The GraceNote GNSDK SDK for Android is affected (before SVN Changeset 1.1.7). A root cause in the Serializable class’s finalize method improperly passes an attacker-controlled pointer to a native function, enabling arbitrary code execution on vulnerable versions. Affected product: GraceNote GNSDK...