CVE-2015-4706

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

CVE-2015-8559

The CVE-2015-8559 issue affects Chef Infra Client’s knife bootstrap command, where versions before 15.4.45 leak the validator.pem private RSA key to /var/log/messages. This exposes sensitive credentials and constitutes an information disclosure vulnerability. Affected component: knife bootstrap i...

CVE-2015-4706

CVE-2015-4706 affects IPython 3.x before 3.2. It is a cross-site scripting (XSS) vulnerability where remote attackers can inject arbitrary web script or HTML via JSON error messages and the /api/contents path. Connected advisories (GHSA, OSV, CNVD/NVD variants) consistently describe the same issu...

CVE-2015-5284

CVE-2015-5284 (FreeIPA) Impact: In FreeIPA versions before 4.2.2, ipa-kra-install stores the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem with world-readable permissions. This could allow an attacker to access the CA private key and potentially issue certificates (effect...

CVE-2015-3296

CVE-2015-3296: NodeBB before 0.7 is affected by cross-site scripting in its Markdown processing, allowing remote attackers to inject arbitrary script via javascript: or data: URLs. The vulnerability is tied to insufficient input filtering in the Markdown/html rendering path (markdown-it-based) in...

CVE-2015-9232

The CVE-2015-9232 entry affects the Good for Enterprise Android app (version 3.0.0.415). The underlying issues are: (1) Authentication Delegation API intent does not use signature protection, and (2) the Good Dynamic activation process does not detect malicious activation attempts involving modif...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

CVE-2015-9231

CVE-2015-9231 affects iTerm2 3.x prior to 3.1.1. A default feature introduced in iTerm2 3.0.0 caused the text under the cursor (or selection) to be sent as unencrypted DNS queries when checking if it was a URL, potentially disclosing passwords and other sensitive data over the network. Public ent...

DEBIAN-CVE-2015-6673

Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32...

CVE-2015-5608

Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1...

CVE-2015-6673

Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32...

CVE-2015-4707

Cross-site scripting XSS vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path...

CVE-2015-5395

Cross-site request forgery CSRF vulnerability in SOGo before 3.1.0...

CVE-2015-1865

fts.c in coreutils 8.4 allows local users to delete arbitrary files...

CVE-2015-1865

fts.c in coreutils 8.4 allows local users to delete arbitrary files...

CVE-2015-5395

Cross-site request forgery CSRF vulnerability in SOGo before 3.1.0...

CVE-2015-2927

node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service bandwidth consumption...

CVE-2015-2927

node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service bandwidth consumption...

CVE-2015-4707

Cross-site scripting XSS vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path...

CVE-2015-2826

The CVE-2015-2826 entry concerns the WordPress Simple Ads Manager plugin, specifically versions 2.5.94 and 2.5.96. A vulnerability in the sam-ajax-admin.php path allows remote attackers to disclose sensitive information. The PoC indicates a POST request to /wp-content/plugins/simple-ads-manager/s...