Design/Logic Flaw

mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700...

Directory traversal

Directory traversal vulnerability in getfile.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this...

CVE-2015-3206

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

CVE-2015-1325

CVE-2015-1325 is a race-condition vulnerability in Apport. It affects Ubuntu-packaged versions prior to 2.17.2-0ubuntu1.1 (Ubuntu 15.04), prior to 2.14.70ubuntu8.5 (14.10), prior to 2.14.1-0ubuntu3.11 (14.04 LTS), and prior to 2.0.1-0ubuntu17.9 (12.04 LTS). The issue allows local users to write t...

CVE-2015-1324

CVE-2015-1324 affects Ubuntu’s Apport before 2.17.2-0ubuntu1.1 (Ubuntu 15.04) and older packages on 14.04/14.10/12.04 releases. The issue arises from incorrect handling of permissions when generating core dumps for setuid binaries, enabling local users to write to arbitrary files and gain root pr...

CVE-2015-4017

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

CVE-2015-3206

CVE-2015-3206 affects the pykerberos library (checkPassword) where the KDC is not authenticated, enabling potential MITM or DoS via spoofed KDC responses. Connected sources indicate mitigations include enabling KDC verification (e.g., via a krb5.keytab and related verify option) and applying patc...

CVE-2015-5700

CVE-2015-5700 affects mktexlsr (texlive): revisions 22855–36625 packaged in texlive allow local users to write to arbitrary files via a symlink attack. Root cause is a symlink vulnerability; this is tied to packaging in texlive. Some notices also reference a reversal of a fix (CVE-2015-5701). The...

CVE-2015-3211

Technical details about CVE-2015-3211 are not publicly available in the provided documents. Monitor for updates from vendors/security bulletins.

CVE-2015-1324

Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root...

CVE-2015-5701

CVE-2015-5701 concerns mktexlsr in texlive. The vulnerability affects mktexlsr revision 36855 and earlier revisions 36626 as packaged in texlive, allowing local users to write to arbitrary files via a symlink attack. The issue arises from the reversion of the fix for CVE-2015-5700. No exploitatio...

CVE-2015-4180

CVE-2015-4180 is a directory-traversal vulnerability in phpMyBackupPro get_file.php for versions 2.1–2.4 that allows remote attackers to read arbitrary files via .. in the view parameter. The issue stems from an incomplete fix to CVE-2009-4050. Some sources extend exposure to 2.5 (as per related ...

CVE-2015-4017

CVE-2015-4017 describes a vulnerability in Salt prior to 2014.7.6 where certificate verification is not performed when Salt connects via the aliyun, proxmox, and splunk modules. According to the connected SUSE/OSV records, the issue centers on Salt’s failure to validate certificates, potentially ...

CVE-2015-4017

Removed by vendor...

CVE-2015-1395

CVE-2015-1395 is a directory traversal vulnerability in GNU patch that affects versions before 2.7.3. An attacker can write to arbitrary files with the permissions of the target user via a .. in a diff file name. The vulnerability is referenced in multiple advisories across Linux distros (e.g., E...

CVE-2015-3257

The CVE-2015-3257 entry affects Zend/Diactoros (Uri::filterPath) prior to version 1.0.4. The root cause is improper sanitization of path input, enabling remote attackers to perform cross-site scripting (XSS) or open redirects. The impact is client-facing URL parsing vulnerabilities that could lea...

CVE-2015-5700

mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack...

CVE-2015-4699

Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...

CVE-2015-4699

Cross-site scripting XSS vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI...

CVE-2015-8352

CVE-2015-8352 affects Zen Cart 1.5.4 and is a Local File Inclusion vulnerability triggered by directory traversal in the Ajax endpoint. The flaw occurs in the /ajax.php act parameter processing, allowing remote, unauthenticated attackers to include and execute arbitrary local PHP files, potential...