CVE-2015-4699

The affected product is Cloud4Wi Splash Portal (before version 5.9.7). A Cross-Site Scripting (XSS) vulnerability exists in the Splash Portal that allows remote attackers to inject arbitrary web script or HTML by supplying malicious input to the recoveryMessage parameter in the default URI. This ...

CVE-2015-8355

The CVE-2015-8355 entry concerns the orion.extfeedbackform Bitrix module, specifically versions before 2.1.3. The vulnerability is SQL injection in the admin/orion.extfeedbackform_efbf_forms.php script, exploitable via the GET parameters order and by; an authenticated user could execute arbitrary...

CVE-2015-5146

ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service service crash via a NULL byte in a crafted configuration...

DEBIAN-CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

Memory corruption

LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service memory corruption and SIGSEGV via a crafted image file...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-7257

The CVE-2015-7257 entry concerns ZTE ADSL ZXV10 W300 modems (versions W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57). A remote authenticated non-administrator user can change the administrator password by intercepting an outgoing password-change request and tampering the username parameter fr...

CVE-2015-7259

ZTE ADSL ZXV10 W300 modems (W300V2.1.0f_ER7_PE_O57, W300V2.1.0h_ER7_PE_O57) expose an authentication flaw where a remote authenticated user can log in to a target account using any valid username/password pair, effectively enabling unauthorized access via multiple credential pairs (information di...

CVE-2015-8308

LXDM (Lightweight Display Manager for LXDE) before 0.5.2 fails to start the X server with the -auth parameter, allowing a local user to bypass authentication via X connections. The concrete affected version is LXDM

CVE-2015-1801

The CVE-2015-1801 entry concerns the Samsung S4 GT-I9500 with the samsung_extdisp driver (kernel 3.4 and earlier). The root cause is a memory corruption flaw in the samsung_extdisp pathway, enabling a local attacker to cause a denial of service or gain privileges. Connected sources reference the ...

CVE-2015-7896

LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service memory corruption and SIGSEGV via a crafted image file...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-5146

Removed by vendor...

CVE-2015-7896

CVE-2015-7896 affects Samsung Galaxy S6’s LibQjpeg image decoder. A crafted image can trigger a memory corruption in LibQjpeg, causing remote denial of service (memory corruption and SIGSEGV). Root cause: memory corruption in the image parsing/processing path. Affected software/hardware: Samsung ...

CVE-2015-5146

CVE-2015-5146 affects ntpd up to version 4.2.8p3 when remote configuration is enabled. An authenticated attacker with knowledge of the configuration password and access to a machine entrusted to perform remote configuration can crash ntpd by sending a crafted configuration directive packet contai...

CVE-2015-7259

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...

CVE-2015-7258

CVE-2015-7258 affects ZTE ADSL ZXV10 W300 modems (W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57). The CNVD/NVD entries describe an information-disclosure flaw where remote authenticated users can obtain user passwords by displaying user information in a Telnet connection. The root cause detai...

CVE-2015-1800

CVE-2015-1800 affects the Samsung S4 GT-I9500 with kernel 3.4 and earlier, via the samsung_extdisp driver. Multiple connected sources indicate the s3cfb_extdsp_ops.c/samsung_extdisp path could disclose sensitive information to a local attacker, enabling information disclosure without requiring us...

CVE-2015-7516

CVE-2015-7516 affects ONOS before 1.5.0 when using the ifwd app. A remote attacker can cause a denial of service by sending two Ethernet frames with ether_type 0x8870, triggering a NULL pointer dereference and switch disconnect. The available documents describe the impact as DoS but do not specif...