CVE-2015-1239

CVE-2015-1239 is a vulnerability in OpenJPEG (used by PDFium in Google Chrome) where a double free in j2k_read_ppm_v3 can cause a remote-denial of service (process crash) via a crafted PDF. Affected software is OpenJPEG prior to r2997; impact is crash/DoS with no confidentiality or integrity loss...

CVE-2015-5164

CVE-2015-5164 affects the Qpid server used by Red Hat Satellite 6. The issue arises from improper restriction of message types, enabling remote authenticated administrators on a managed content host to execute arbitrary code via a crafted message, tied to a pickle processing problem in pulp. Publ...

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

CVE-2015-2156

CVE-2015-2156 concerns Netty (and Play Framework): improper validation of cookie name/value characters can bypass HttpOnly and expose sensitive data. In IBM StreamSets Data Collector context, this vulnerability affects versions 5.0.0–6.4.1 and remediation is to upgrade to IBM StreamSets Data Coll...

CVE-2015-3400

The CVE-2015-3400 entry concerns sharenfs 0.6.4 when built with specific commits (bcdd594 and 7d08880) in the zfs repository. The description states that this configuration provides world-readable access to the shared ZFS filesystem, which could allow remote authenticated users to read shared fil...

Oracle Business Intelligence Publisher Multiple Vulnerabilities (October 2017 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.171017 or 11.1.1.9.x prior to 11.1.1.9.171017. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CV...

CVE-2015-7806

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7806

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7806

The CVE-2015-7806 issue affects the WordPress Form Manager plugin (prior to 1.7.3). The vulnerability is in the fm_saveHelperGatherItems function of ajax.php, enabling remote code execution via unspecified vectors. Multiple sources confirm RCE potential, including CNVD and WPVulndB entries noting...

CVE-2015-7504

CVE-2015-7504 is a heap-based buffer overflow in the PC-Net II ethernet controller (hw/net/pcnet.c) of QEMU, exposed via guest-controlled packet reception. The flaw in pcnet_receive can lead to denial of service (instance crash) or possibly arbitrary code execution when handling a sequence of pac...

CVE-2015-3229

fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic updates...

CVE-2015-7687

Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...

CVE-2015-7687

Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...

CVE-2015-7687

CVE-2015-7687 affects OpenSMTPD before 5.7.2, with a use-after-free in verification paths (req_ca_vrfy_smtp and req_ca_vrfy_mta). Remote attackers can cause denial of service or execute arbitrary code. Remediation: upgrade to OpenSMTPD 5.7.2 or later (per vendor release notes).

CVE-2015-3229

fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic updates...

CVE-2015-3229

CVE-2015-3229 affects fedora-cloud-atomic.ks within spin-kickstarts. The vulnerability arises from downloading Fedora Atomic updates over HTTP, which enables remote attackers to perform man-in-the-middle attacks. Impact is exposure of update integrity/authenticity, potentially allowing tampered u...

CVE-2015-4650

Aruba Networks ClearPass Policy Manager is affected by CVE-2015-4650 in versions prior to 6.4.7 and in the 6.5.x line prior to 6.5.2. Remote attackers can gain shell access and execute arbitrary code with root privileges via unspecified vectors. Mitigations: upgrade to ClearPass 6.4.7 or 6.5.2 (o...

Design/Logic Flaw

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication...

CVE-2015-6358

Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another...