CVE-2015-2674

CVE-2015-2674 affects Restkit written in Python, where TLS server verification can be bypassed by using ssl.wrap_socket with cert_reqs set to CERT_NONE, enabling MITM spoofing. The vulnerability is caused by the default no-verification configuration in SSL/TLS handling within Restkit and is docum...

CVE-2015-0782

The CVE-2015-0782 entry concerns Novell ZENworks Configuration Management (ZCM). The ScheduleQuery method in the Schedule class is vulnerable to SQL injection via unsanitized input, allowing remote attackers to execute arbitrary SQL commands. Multiple connected sources describe the vulnerability ...

CVE-2015-0786

CVE-2015-0786 corresponds to a stack-based buffer overflow in the Preboot Policy Service of Novell ZENworks Configuration Management (ZCM). The vulnerability arises in the service’s logging functionality and allows remote attackers to execute arbitrary code. Several connected advisories corrobora...

CVE-2015-2312

Cap'n Proto (Sandstorm Cap'n Proto) vulnerable in versions before 0.4.1.1 and 0.5.x before 0.5.1.1. A remote attacker can cause denial of service by sending a message containing a list with a very large number of elements, leading to CPU/general resource exhaustion. A related CVE-2015-2313 indica...

CVE-2015-7894

CVE-2015-7894 affects Samsung LibQjpeg’s DCMProvider on a Samsung SM-G925V with build LRX22G.G925VVRU1AOE2. The vulnerability enables remote attackers to trigger a denial of service (segmentation fault/process crash) and execute arbitrary code by crafting a JPEG file, as described in multiple sou...

CVE-2015-1820

REST client for Ruby aka rest-client before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect...

CVE-2015-3277

Removed by vendor...

CVE-2015-2291

1 IQVW32.sys before 1.3.1.0 and 2 IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted a 0x80862013, b 0x8086200B, c 0x8086200F, or d 0x80862007 IOCTL...

CVE-2015-2313

CVE-2015-2313 affects Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2. The vulnerability occurs when an application calls the totalSize method on an object reader, allowing remote peers to cause a denial of service (CPU consumption) via a crafted small message that triggers a tight ...

CVE-2015-0786

Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management ZCM allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-2311

CVE-2015-2311 affects Sandstorm Cap'n Proto prior to 0.4.1.1 and 0.5.x prior to 0.5.1.1. The issue is an integer underflow in the handling of crafted messages, which may allow remote peers to cause denial of service, leak memory, or potentially execute arbitrary code. Physical impact and exploit ...

CVE-2015-6816

CVE-2015-6816 affects ganglia-web prior to 3.7.1, where an authentication bypass is possible due to a boolean deserialization error in GangliaAuth.php. This allows remote attackers to bypass authentication on vulnerable installations. A fix is available in ganglia-web 3.7.1 (upgrade recommended)....

CVE-2015-0784

This CVE affects Novell ZENworks Configuration Management (ZCM). The vulnerability is in Rtrlet.class, where a remote attacker can obtain Session IDs of logged-in users by sending a POST request with the maintenance variable set to ShowLogins. The issue is an information-disclosure flaw; exploita...

CVE-2015-2310

Summary (CVE-2015-2310) : An integer overflow in Sandstorm Cap'n Proto’s layout.c++ causes a vulnerability when processing crafted messages. Affected versions are Cap'n Proto prior to 0.4.1.1 and 0.5.x prior to 0.5.1.1. The flaw, related to pointer validation, can allow remote peers to trigger a ...

CVE-2015-2312

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service CPU and possibly general resource consumption via a list with a large number of elements...

CVE-2015-0780

CVE-2015-0780 affects Novell ZENworks Configuration Management (ZCM). The GetReRequestData method of the GetStoredResult class is vulnerable to SQL injection, allowing remote attackers to manipulate the database by injecting SQL through unspecified vectors. Connected advisories corroborate the vu...

CVE-2015-3277

CVE-2015-3277 affects the mod_nss module in Fedora, vulnerable versions are before 1.0.11. The root cause is incorrect parsing of multi-keyword cipherstrings, allowing remote attackers to obtain cipher lists. Impact is information disclosure of cipher lists; CVSS v3 base 7.5 (HIGH) per NVD. Remed...

CVE-2015-0785

The CVE-2015-0785 issue affects Novell ZENworks Configuration Management (ZCM), specifically the DirectoryViewer path handling in com.novell.zenworks.inventory.rtr.actionclasses.wcreports. The root cause is a failure to sanitize the dirname variable, enabling a remote attacker to read arbitrary f...

CVE-2015-6498

Affected product: Alcatel-Lucent Home Device Manager before 4.1.10 and 4.2.x before 4.2.2. Vulnerability: remote attackers can spoof and make calls as target devices. Root cause details are not provided beyond the spoofing capability. Impact: enables spoofing of calls to target devices. Remediati...

CVE-2015-2291

CVE-2015-2291 affects Intel Ethernet diagnostics drivers IQVW32.sys and IQVW64.sys (Windows). The connected exploit write-up details a local-privilege-escalation path via IOCTL handling, where a memmove-like dispatch (via a jump-table 0x33) enables arbitrary kernel memory read/write by crafting a...