CVE-2015-2143

Issue: CVE-2015-2143 affects Issuetracker phpBugTracker prior to v1.7.0 with multiple CSRF vulnerabilities that can hijack user sessions for requests causing unspecified impact. Affected component: Issuetracker/phpBugTracker; root cause described as cross-site request forgery. Documented impact r...

CVE-2015-0296

The CVE-2015-0296 entry concerns the TeX Live package scripts. The pre-install script in texlive 3.1.20140525_r34255.fc21 (Fedora 21) and texlive 6.20131226_r32488.fc20 (and related RPMs) allows an unprivileged local user to delete arbitrary files by placing a crafted file in the user’s home dire...

CVE-2015-1429

CVE-2015-1429 affects Cybele Software Thinfinity Remote Desktop Workstation (version 3.0.0.3, 32-bit and 64-bit). A directory traversal vulnerability exists where a remote attacker can download arbitrary files via a .. (dot dot) in an unspecified parameter. Multiple trusted sources (CNVD-2017-308...

CVE-2015-2147

Issuetracker phpBugTracker is affected by a SQL injection vulnerability in versions before 1.7.0. The issue allows remote attackers to execute arbitrary SQL commands via unspecified parameters. The connected CNVD entry confirms the existence and affected version range; no mitigation or patch deta...

CVE-2015-2142

Issuetracker phpBugTracker, versions prior to 1.7.0, contains multiple CSRF vulnerabilities that allow remote authenticated users to hijack authentication of other users via various parameter tampering (id, group_id, status_id, severity_id, priority_id, os_id, database_id, site_id) across project...

CVE-2015-2144

Issuetracker phpBugTracker is affected by multiple XSS vulnerabilities in versions before 1.7.0. Remote authenticated users can inject arbitrary script/HTML via several fields: project name (project.php), use_js (user.php and group.php), Description (status.php, severity.php), Regex (os.php), and...

CVE-2015-2146

Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to project.php, the 2 groupid parameter to group.php, the 3 statusid parameter to status.php, the 4 resolutionid parameter to...

CVE-2015-2145

Issuetracker phpBugTracker contains multiple XSS flaws in versions prior to 1.7.0. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML through unspecified parameters, potentially affecting any pages that render user-supplied input. The root cause is improper sanitiza...

CVE-2015-1206

Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service unpaged memory write and process crash via a crafted MP4 file...

CVE-2015-2158

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

CVE-2015-2297

nanohttp in libcsoap allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted Authorization header...

AZL-44265 CVE-2015-2158 affecting package fltk for versions less than 1.3.8-1

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

UBUNTU-CVE-2015-2297

nanohttp in libcsoap allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted Authorization header...

CVE-2015-2158

The CVE-2015-2158 entry describes an off-by-one bug in pngcrush_measure_idat() in pngcrush.c, affecting pngcrush before 1.7.84. A crafted PNG file can trigger a denial of service (crash) and may allow arbitrary code execution. Publicly documented details confirm the vulnerable component and the r...

CVE-2015-1206

CVE-2015-1206 affects Google Chrome prior to M40, where a heap-based buffer overflow in the MP4 handling path allows remote attackers to trigger a denial of service (unpaged memory write and process crash) via a crafted MP4 file. The available documents confirm the vulnerable component and impact...

CVE-2015-2158

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

CVE-2015-1206

Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service unpaged memory write and process crash via a crafted MP4 file...

CVE-2015-1206

Removed by vendor...

CVE-2015-5246

Technical details about CVE-2015-5246 are not publicly available in the provided connected documents. The sources summarize an LDAP authentication issue in Foreman but do not specify affected versions, exploit methods, or fixes. Monitor for updates.

DEBIAN-CVE-2017-1000253

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 committed on April 14, 2015. This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 backported to Linux 3.10.7...