CVE-2015-5699

The CVE-2015-5699 entry concerns Cumulus Linux 2.5.3 and earlier, where the Switch Configuration Tools Backend (clcmd_server) is vulnerable to local command injection. The vulnerability arises because clcmd_server executes shell commands appended to the end of a cl-rctl command label if the label...

CVE-2015-4422

CVE-2015-4422 concerns Huawei Mate 7 devices (Mate7-TL10) in the TEEOS module. A local attacker with root permissions can escalate privileges or trigger memory corruption leading to denial of service via a crafted app. The affected product is described as the Mate 7 with TEEOS, before the patch v...

CVE-2015-6668

The WordPress Job Manager plugin vulnerable versions before 0.7.25 allow remote attackers to read arbitrary CV files via an insecure direct object reference by brute-forcing the WordPress upload directory. Impact: CV file disclosure; attack vector: network, no authentication required. Remediation...

CVE-2015-4421

The CVE-2015-4421 issue affects Huawei Mate 7tzdriver and TEEOS. A flawed input check in the /dev/tc_ns_client kernel interface allows a user-space process to influence trusted execution environment calls, enabling local privilege escalation or memory corruption that can lead to a denial of servi...

CVE-2015-4422

The TEEOS module in Huawei Mate 7 Mate7-TL10 smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service memory corruption via a crafted application...

CVE-2015-5739

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."...

CVE-2015-5739

CVE-2015-5739 affects Go’s net/http implementation (net/textproto/reader.go) prior to Go 1.4.3. The vulnerability arises from improper parsing of HTTP header keys, enabling remote attackers to perform HTTP request smuggling by using a space instead of a hyphen (e.g., “Content Length” vs “Content-...

CVE-2015-5376

SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field...

CVE-2015-5376

GSI WiNPAT Portal (GSI Office Management, Germany) is affected by CVE-2015-5376 through versions 3.2.0.1001–3.6.1.0. The vulnerability is a SQL injection in the login form, exploitable via the username field that allows a remote attacker to execute arbitrary SQL commands. The connected CNVD entry...

CVE-2015-5740

The CVE affects the Go net/http implementation (net/http/transfer.go) in versions before 1.4.3. The root cause is improper parsing of HTTP headers, which enables HTTP request smuggling via a request containing two Content-Length headers. The impact described across connected sources is remote, wi...

CVE-2015-5227

The CVE refers to WordPress Landing Pages plugin prior to 1.9.2, where remote code execution is possible via the url parameter. Affected versions are

UBUNTU-CVE-2015-7943

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vector...

CVE-2015-7714

CVE-2015-7714 affects Realtyna RPL (com_rpl) Joomla! extension. Multiple SQL injection vectors exist via administrator/index.php parameters (id, copy_field in data_copy, pshow in update_field, css, tip, cat_id, text_search, plisting, pwizard). Affected versions are before 8.9.5. Exploitation allo...

CVE-2015-7715

Cross-site request forgery CSRF vulnerability in the Realtyna RPL comrpl component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an adduser action to administrator/index.php...

CVE-2015-7943

Removed by vendor...

CVE-2015-7715

The CVE covers a CSRF vulnerability in Realtyna RPL (com_rpl) for Joomla!, affecting versions prior to 8.9.5. The issue allows an attacker to hijack an administrator’s session by triggering an add_user action via administrator/index.php, enabling remote user creation without proper authorization....

CVE-2015-7943

CVE-2015-7943 describes an open redirect vulnerability in Drupal 7.x where the Overlay module does not sufficiently validate URLs, enabling redirects to arbitrary sites and phishing via unspecified vectors. Affected are: Drupal core Overlay module in 7.x before 7.41; the jQuery Update module (7.x...

CVE-2015-1239

Double free vulnerability in the j2kreadppmv3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service process crash via a crafted PDF...

CVE-2015-1239

Double free vulnerability in the j2kreadppmv3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service process crash via a crafted PDF...

CVE-2015-1239

Double free vulnerability in the j2kreadppmv3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service process crash via a crafted PDF...