35974 matches found
CVE-2015-7316
Cross-site scripting XSS vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1...
CVE-2015-6748
Cross-site scripting XSS vulnerability in jsoup before 1.8.3...
CVE-2015-7318
CVE-2015-7318 affects Plone 3.3.0–3.3.6, where remote attackers could inject headers into HTTP responses. The primary source states vulnerable component/version and the impact is header injection in Plone’s HTTP responses. Public references indicate the issue is fixed by a vendor-provided securit...
CVE-2015-4667
Multiple hardcoded credentials in Xsuite 2.x...
CVE-2015-7317
CVE-2015-7317 affects Kupu editor versions 3.3.0–3.3.6, 4.0.0–4.0.10, 4.1.0–4.1.6, and 4.2.0–4.2.7. The vulnerability allows remote authenticated users to edit Kupu settings. The provided sources (NVD entry and related Nessus/ CNVD records) confirm the affected ranges and the permission context b...
CVE-2015-5282
Foreman (versions 1.7.0 and later) has a documented Cross‑Site Scripting (XSS) vulnerability that allows a remote attacker to execute HTML. The CNVD entry notes Foreman 1.7.0+ is affected and references a commit (4f3555b217be8723e8045f9816d147b5f684ec57) as part of the fix, indicating a remediati...
CVE-2015-5237
CVE-2015-5237 affects Google Protocol Buffers (protobuf). Root cause: integer/heap overflow in MessageLite::SerializeToString leading to a heap‑based buffer overflow. Exploitation could enable remote code execution or denial of service by remote authenticated attackers. In IBM DataStage for Cloud...
CVE-2015-5237
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow...
CVE-2015-7315
This CVE affects Plone platforms: Plone 3.3.0–3.3.6, 4.0.0–4.0.10, 4.1.0–4.1.6, 4.2.0–4.2.7, 4.3.0–4.3.6, and 5.0rc1. Root cause: remote attackers could add a new member to a Plone site with registration enabled without administrator acknowledgment. Impact stated: unauthorized user addition (no d...
CVE-2015-7317
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings...
CVE-2015-4667
CVE-2015-4667 affects Xceedium Xsuite 2.x (notably versions 2.3.0 and 2.4.3.0). The connected documents describe multiple hardcoded credentials vulnerabilities, including a hard-coded database password (n1b2dy) and broader issues in Xsuite 2.x that enable remote/ local access. Additional related ...
CVE-2015-4669
The CVE-2015-4669 entry pertains to Xceedium Xsuite 2.x where the MySQL root user has no password set, allowing Local access to the databases. The connected documents corroborate that this vulnerability enables local users to access databases and, in combination with other issues (e.g., command i...
CVE-2015-6748
CVE-2015-6748 affects the jsoup HTML parser library with a cross-site scripting (XSS) vulnerability present in versions before 1.8.3. Exploitation details are not provided in the documents beyond the XSS note; remediation is to upgrade to jsoup 1.8.3 or later.
CVE-2015-7316
CVE-2015-7316 is a cross-site scripting (XSS) vulnerability in Plone affecting versions 3.3.0–3.3.6, 4.0.0–4.0.10, 4.1.0–4.1.6, 4.2.0–4.2.7, 4.3.x before 4.3.7, and 5.0rc1. The provided documents do not include root-cause details beyond the XSS description, nor do they specify exploitation status...
A simple example of a complex cyberattack
We're already used to the fact that complex cyberattacks use 0-day vulnerabilities, bypassing digital signature checks, virtual file systems, non-standard encryption algorithms and other tricks. Sometimes, however, all of this may be done in much simpler ways, as was the case in the malicious...
Elastic Elasticsearch Snapshot API Directory Traversal (CVE-2015-5531)
A directory traversal vulnerability exists in Elastic Elasticsearch. The vulnerability is due to insufficient validation on a user-supplied path when a request is sent to access a snapshot repository. A remote, unauthenticated attacker could exploit the vulnerability by sending crafted packets to...
CVE-2015-3887
CVE-2015-3887 affects ProxyChains-NG up to version 4.9. The vulnerability arises from an untrusted search path: a Trojan horse library libproxychains4.so placed in the current working directory can be loaded via LD_PRELOAD, allowing local privilege escalation. Exploitation is local with no user i...
CVE-2015-1187
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the pingaddr parameter to ping.ccp...
CVE-2015-1187
CVE-2015-1187 is a remote command injection vulnerability in the NCC service used by multiple D-Link and TRENDnet devices. The ping handling (ping_addr to ping.ccp) enables an attacker to execute arbitrary commands, causing full remote code execution with high impact (CVE-2015-1187 CVSS v3.1 base...
