CVE-2015-2319

CVE-2015-2319: Mono’s TLS stack vulnerability (pre-3.12.1) facilitates cipher-downgrade to EXPORT_RSA ciphers via crafted TLS traffic, related to the FREAK issue. The advisory notes this is a distinct issue from CVE-2015-0204. Affected product: Mono TLS up to version 3.12.0; fix is to upgrade to ...

CVE-2015-2318

The CVE-2015-2318 entry concerns the Mono TLS stack prior to version 3.12.1. The issue, called SMACK SKIP-TLS, arises from missing handshake state validation, enabling man-in-the-middle attackers to exploit message skipping and impersonate clients. Affected software: Mono’s TLS implementation (pr...

CVE-2015-2320

CVE-2015-2320 affects the Mono TLS stack prior to 3.12.1, where the vulnerability arises from client-side SSLv2 fallback. The description specifies that remote attackers can cause unspecified impact. The included metrics show a base score of 7.5 (CVSSv2) and a 9.8 (CVSSv3) with network access and...

CVE-2017-2015

...

CVE-2017-2015

CVE-2017-2015 is rejected; this CVE ID is not an active vulnerability entry.

CVE-2015-4852

creationtimestamp| type| source ---|---|--- 2018-01-05 01:08:44+00:00| seen| MISP/5a4ecbf4-1b24-4a5f-9f4d-4b7c98036464 2019-03-26 22:18:44+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogicdeserializerawobject.rb 2019-03-28 00:00:00+00:00|...

Debian: Security Advisory (DLA-693-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Joomla Advertisement Board Classifieds 3.2.0 Shell Upload

Title: Advertisement board Joomla classifieds extension 3.2.0 - Remote Shell Upload Vulnerability Credit: Bilal KARDADOU Vendor: http://ordasoft.com/ URL: http://ordasoft.com/advertisement-board-joomla-classifieds-extension Product: 'Advertisement board Joomla classifieds extension 3.2.0'...

Magento Commerce - SSRF & XSPA Web Vulnerability

Document Title: =============== Magento Commerce - SSRF & XSPA Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1631 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID VL-ID: ==================================== 1631 Comm...

Magento Commerce - SSRF & XSPA Web Vulnerability

Document Title: =============== Magento Commerce - SSRF & XSPA Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1631 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID VL-ID: ==================================== 1631 Comm...

CVE-2015-3302

TheCartPress WordPress plugin (TheCartPress, aka The Professional WordPress eCommerce Plugin) for WordPress is affected by CVE-2015-3302. The vulnerability arises from a broken authentication mechanism that permits non-authenticated users to access sensitive order data due to improper access cont...

CVE-2015-8008

CVE-2015-8008 relates to the MediaWiki OAuth extension. The description states that it improperly negotiates a new client token only over Special:OAuth/initiate, enabling attackers to bypass IP address access restrictions by making an API request with an existing token. The provided data does not...

CVE-2015-7889

The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICKREPLYBACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain...

CVE-2015-7668

Cross-site scripting XSS vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mapid parameter...

CVE-2015-7666

Multiple cross-site scripting XSS vulnerabilities in the 1 cpupdateMessageItem and 2 cpdeleteMessageItem functions in cppppadminintmessagelist.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal...

CVE-2015-7669

The CVE-2015-7669 entry affects the WordPress Easy2Map plugin prior to version 1.3.0. The vulnerability is a directory traversal / Local File Inclusion issue in the includes/MapImportCSV2.php and includes/MapImportCSV.php scripts, allowing remote attackers to supply a csvfile parameter via the up...

CVE-2015-7668

Cross-site scripting XSS vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mapid parameter...

CVE-2015-7667

Multiple cross-site scripting XSS vulnerabilities in 1 templates/admanagement/admanagement.php and 2 templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2015-7667

CVE-2015-7667 concerns the WordPress ResAds plugin (versions before 1.0.2). The vulnerability is a cross-site scripting (XSS) flaw in templates/admanagement/admanagement.php and templates/adspot/adspot.php that allows remote attackers to inject arbitrary script or HTML via the page parameter. Aff...

CVE-2015-7666

CVE-2015-7666 documents multiple XSS vulnerabilities in the WordPress plugin Payment Form for PayPal Pro (before 1.0.2). The flaw resides in cp_ppp_admin_int_message_list.inc.php functions cp_updateMessageItem and cp_deleteMessageItem, where the cal parameter can be exploited to inject arbitrary ...