CVE-2015-0853

Removed by vendor...

CVE-2015-5186

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames...

CVE-2015-2943

CVE-2015-2943 affects Honda Moto LINC 1.6.1, where the application fails to verify SSL server certificates. The underlying issue is improper SSL certificate validation in the client, enabling a potential man-in-the-middle to eavesdrop on encrypted traffic. Public sources (NVD entry for CVE-2015-2...

CVE-2015-6250

CVE-2015-6250 affects the simple-php-captcha project. A vulnerability in the captured code before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate CAPTCHA responses by running the same code on the client-side, effectively bypassing CAPTCHA verifica...

CVE-2015-7294

CVE-2015-7294 affects ldapauth-fork before 2.3.3, where a remote attacker can trigger LDAP injection through a crafted username parameter. The vulnerability is linked to the ldapauth-fork library used for authenticating against LDAP servers. Several connected sources confirm the affected version ...

CVE-2015-3163

Beaker before 20.1 has broken access control on admin pages for power types and key types, allowing remote authenticated users to modify these types by visiting /powertypes and /keytypes. The vulnerability is tied to missing access controls on those admin endpoints; the exact root cause or code p...

CVE-2015-0853

svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$xeyes...

CVE-2015-5959

CVE-2015-5959 affects Froxlor prior to 0.9.33.2, where default installations could disclose the database password by reading the /logs/sql-error.log file. Multiple sources (NVD entry and FreeBSD VuXML) describe an unauthenticated information-disclosure scenario tied to the /logs directory permiss...

CVE-2015-3160

CVE-2015-3160 relates to an XML external entity (XXE) vulnerability in Beaker’s Beaker project, specifically in the bkr/server/jobs.py module. Before version 20.1, remote authenticated users can submit job XML containing entity references that reference files on the Beaker server’s filesystem, po...

CVE-2015-3161

The CVE affects Beaker prior to version 20.1. The search bar code in bkr/server/widgets.py fails to escape tags in string literals when producing JSON, enabling potential cross‑site/script injection via JSON output. The Beaker vulnerability is described consistently across sources (NVD/NVD-deriv...

CVE-2015-5705

CVE-2015-5705 affects devscripts prior to 2.15.7. The issue allows remote attackers to overwrite arbitrary files via a crafted symlink and filename, due to an argument injection vulnerability in devscripts. Impact is arbitrary file writes; several advisories note fixes in 2.15.7 and later (e.g., ...

CVE-2015-2210

Epicor CRS Retail Store contains a local code execution flaw in the Help window (v3.2.03.01.008). By injecting JavaScript into the Help window source, an attacker can create a button that spawns a command shell, via an ActiveX payload, allowing a local user to run arbitrary commands. Affected com...

CVE-2015-5705

Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename...

CVE-2015-8316

CVE-2015-8316 affects LightDM. The vuln is an array index error in LightDM when the XDMCP server is enabled, allowing a remote attacker to cause a denial of service (process crash). Impact is described for affected versions: LightDM 1.14.3 and 1.16.x before 1.16.6 . The entry notes the attack is ...

CVE-2015-7241

CVE-2015-7241 describes an XML External Entity (XXE) vulnerability in SAP NetWeaver before 7.01 due to the XML parser. The vulnerability allows potential unauthorized access and data exposure via XXE, as documented in multiple sources (NVD, CNVD, CVE lists) and corroborated by exploitation refere...

CVE-2015-7225

Concretely, CVE-2015-7225 affects devise-two-factor prior to v4.0.2, where an OTP can be reused for one immediately trailing time interval due to an incomplete fix. Multiple connected records (e.g., CVE-2021-43177 references) confirm the vulnerability pattern and the remediation: upgrade to devis...

CVE-2015-5948

Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947...

CVE-2015-3162

CVE-2015-3162 affects Beaker 20.1 in the Beaker project. Description: a Cross-site scripting (XSS) vulnerability in the edit comment dialog (bkr/server/widgets.py) enables remote authenticated users to inject arbitrary web script or HTML by writing a crafted comment on an acknowledged or nacked c...

CVE-2015-5947

SuiteCRM before 7.2.3 is affected by CVE-2015-5947, which allows remote attackers to execute arbitrary code. The connected documents flag this as a remote-code-execution vulnerability in SuiteCRM prior to 7.2.3, with follow-up notes indicating a related race-condition (CVE-2015-5948) that exists ...

CVE-2015-5186

CVE-2015-5186 affects CP4S (Cloud Pak for Security) components reporting with audit before 2.4.4 not sanitizing escape characters in filenames. Connected data confirms CP4S versions affected: 1.8.1.0, 1.8.0.0, and 1.7.2.0. Remediation is to upgrade to CP4S 1.9.0.0 as specified by IBM’s upgrade gu...