CVE-2015-0904

The CVE-2015-0904 issue affects the Android app “Restaurant Karaoke SHIDAX” (versions 1.3.3 and earlier). The root cause is failure to validate SSL server certificates, which enables a man-in-the-middle attack that can expose sensitive data in encrypted communications. Multiple sources in the con...

CVE-2015-6585

The CVE-2015-6585 vulnerability affects Hancom Hangul Word Processor (Hangul Word Processor) via hwpapp.dll. The root cause involves a type confusion built around para changes and a crafted HWPX file, combined with a crafted heap spray, enabling remote attackers to execute arbitrary code. The con...

CVE-2015-0674

Cross-site scripting XSS vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2015-0674

CVE-2015-0674 is an XSS vulnerability in Cisco Cloud Web Security’s Alert Service (base revision). The issue arises from insufficient input validation, allowing remote attackers to inject arbitrary web script or HTML via unspecified parameters. The connected documents confirm Cisco Cloud Web Secu...

CVE-2015-1438

The CVE-2015-1438 entry concerns Panda Security’s Kernel Memory Access Driver (version 1.0.0.13). The connected data specifies a heap-based buffer overflow in the driver that allows an attacker to execute arbitrary code with kernel privileges by supplying a crafted size input for allocated kernel...

CVE-2015-5187

CVE-2015-5187 pertains to Red Hat Candlepin, where excessive web traffic allows remote attackers to obtain Java exception statements and thus sensitive information. Affected software is Candlepin (Java-based); the root cause is information disclosure via exception details exposed in responses und...

CVE-2015-3171

The CVE-2015-3171 entry concerns sosreport 3.2, where generated sosreport archives are created with weak permissions, allowing local users with access to /var/tmp to read archived contents and disclose sensitive information. The impact is a local information disclosure vulnerability (archive expo...

CVE-2015-3149

CVE-2015-3149 affects OpenJDK8 Hotspot as packaged in Red Hat Enterprise Linux 6 and 7. The vulnerability enables local users to write to arbitrary files via a symlink attack in the Hotspot component, indicating a local escalation risk. Root cause identified as a symlink-based write condition wit...

CVE-2015-4463

The filemanager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL...

CVE-2015-6585

hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type confusion" via an HWPX file containing a crafted para text tag...

CVE-2015-1417

CVE-2015-1417 affects the FreeBSD inet module. When VNET is enabled and 16+ VNETs are present, the TCP reassembly queue limit (1/16 of mbuf clusters) can be reached, allowing remote attackers to exhaust mbufs via multiple concurrent TCP connections and cause a Denial of Service. Affected: FreeBSD...

CVE-2015-8013

CVE-2015-8013 concerns s2k.js in OpenPGP.js, where crafted PGP keys can be decrypted regardless of the provided passphrase, enabling an attacker to bypass authentication if message decryption is used as an authentication mechanism. The concrete technical detail across the connected documents iden...

CVE-2015-1332

The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service application crash or execute arbitrary code via a crafted website...

CVE-2015-4035

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name...

CVE-2015-3243

CVE-2015-3243 affects rsyslog. The issue arises from weak permissions used when generating log files, allowing local users to read files in /var/log/cron and obtain sensitive information. Connected advisories reference RSYSLOG updates/patches from SUSE/OpenSUSE and related vulnerability plugins, ...

CVE-2015-5221

CVE-2015-5221 is a vulnerability in the JasPer JPEG-2000 library (libjasper/mif/mif_cod.c, function mif_process_cmpt). Multiple connected sources confirm a memory safety issue in this area: the core flaw is described as a use-after-free or memory misreference in the mif_process_cmpt path, exploit...

CVE-2015-2798

The CVE is for Joomla! Form Maker component: Contact Form Maker 1.0.1. The vulnerability is an SQL injection in the id parameter of a request, allowing remote attackers to execute arbitrary SQL commands. This is described in the CVE entry as a traditional SQLi affecting the component, with potent...

CVE-2015-3278

CVE-2015-3278 involves the cipherstring parsing code in the NSS compatibility layer, specifically the nss_compat_ossl component, which in multi-keyword mode fails to match the expected cipher set for a given cipher combination. The underlying issue is a mismatch in how cipherstrings are parsed, e...

CVE-2015-4035

CVE-2015-4035 affects the xzgrep utility. Technical details in connected sources show that the vulnerability lies in the scripts/xzgrep.in file within xzgrep, where filenames containing semicolons are not processed correctly. This allows a remote attacker to cause arbitrary code execution if a us...

CVE-2015-4463

The CVE-2015-4463 entry concerns the file_manager component of eFront CMS prior to version 3.6.15.5. Affected software: eFront CMS. What is vulnerable: the file_manager’s file upload handling can be bypassed by remote authenticated users through a crafted parameter appended to the file URL, enabl...