CVE-2015-3931

CVE-2015-3931 affects Microsec e-Szigno (older than 3.2.7.12). The issue is XML Signature Wrapping: an inserted ds:Object payload can cause a valid signature to be displayed for a different document, enabling tampering with digitally signed files. Affected versions are older than 3.2.7.12; fixed ...

CVE-2015-3932

Netlock Mokka before 2.7.8.1204 is affected by an XML signature wrapping vulnerability. An attacker can insert a crafted ds:Object payload into an e-akta signed document, causing signature validation to misrepresent the content. Exploitation context is not detailed in the provided documents, and ...

CVE-2015-5300

CVE-2015-5300 (NTP panic-threshold bypass) is detailed in connected advisory from F5 for BIG-IP products, describing a vulnerability in ntpd where the threshold for the -g option is not correctly enforced. An attacker controlling NTP traffic could cause ntpd to step the clock to an arbitrary valu...

CVE-2015-3421

CVE-2015-3421 affects the WordPress eShop plugin (

CVE-2015-3170

CVE-2015-3170 describes a local denial-of-service in SELinux policy handling. The issue lies in the policy when sysctl fs.protected_hardlinks is set to 0, allowing a local user to create a hardlink to /etc/passwd from a directory named .config and then update selinux-policy, which prevents SSH lo...

CVE-2015-3638

CVE-2015-3638 affects phpMyBackupPro prior to 2.5, where input validation is insufficient. An authenticated remote attacker can inject and execute arbitrary PHP code through the scheduled.php endpoint by supplying crafted values for path, filename, and period, or by injecting PHP into a PHP confi...

CVE-2015-4639

CVE-2015-4639 describes a cross-site scripting (XSS) vulnerability in Koha’s opac-addbybiblionumber.pl. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted list name in Koha versions: 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1. Exploi...

CVE-2015-4639

Cross-site scripting XSS vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name...

CVE-2015-3886

libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors...

CVE-2015-3886

CVE-2015-3886 affects libinfinity prior to 0.6.6-1, which does not validate expired SSL certificates. The vulnerability permits remote attackers to affect the system in an unspecified manner via unknown vectors; no exploitation specifics or products/versions beyond the library are stated in the p...

CVE-2015-3639

CVE-2015-3639 affects phpMyBackupPro 2.5 and earlier. The issue arises from improper sanitization of input strings, enabling a remote authenticated user to store a crafted string in a user configuration file that can lead to arbitrary PHP code execution. The available connected documents confirm ...

CVE-2015-5195

CVE-2015-5195 affects ntpd via ntp_openssl.m4; a crafted statistics or filegen configuration command, if not excluded at compile time, can cause a denial of service with a segmentation fault. Affected product is ntpd/NTP; root cause is an issue in configuration handling when commands are processe...

CVE-2015-5219

CVE-2015-5219 affects the Network Time Protocol (NTP) SNTP components, specifically the sntp utility, prior to version 4.2.7p366. The root cause is an incorrect type conversion in the ULOGTOD function (precision → double) which can cause a crafted NTP packet to trigger an infinite loop in sntp, l...

CVE-2015-5194

CVE-2015-5194: ntpd’s log_config_command in ntp_parser.y allows remote attackers to crash ntpd via crafted logconfig commands. Affected are ntpd before 4.2.7p42; remediation is to upgrade to a fixed version (4.2.7p42+). Connected advisories from F5/IBM detail affected products and patch guidance ...

CVE-2015-3198

The vulnerability CVE-2015-3198 affects the Undertow module of WildFly 9.x (before 9.0.0.CR2) and 10.x (before 10.0.0.Alpha1). It allows remote attackers to disclose JSP source code by requesting a URL ending with a trailing slash, exposing JSP source to partial confidentiality impact. The issue’...

CVE-2015-1323

CVE-2015-1323 affects aptdaemon's simulate dbus method, enabling a local attacker to obtain sensitive information or access files with root permissions. Ubuntu packages were affected across multiple releases (12.04 LTS through 15.04) prior to fixed versions (e.g., 1.1.1+bzr982-0ubuntu32.1 and rel...

CVE-2015-3640

CVE-2015-3640 affects phpMyBackupPro 2.5 and earlier. Root cause: improper escaping of the "." character in request parameters. Preconditions: attacker must be authenticated and know a web‑accessible, web‑writable directory. Exploit: can inject and execute arbitrary PHP scripts by supplying malic...

F5 Networks BIG-IP : libxml2 vulnerability (K45439210)

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service out-of-bounds heap memory access and application crash, or possibly have unspecified other impact via an unclosed HTML comment. CVE-2015-8710 C Tenable Network...

EulerOS 2.0 SP1 : ImageMagick (EulerOS-SA-2017-1116)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service CPU consumption via a crafted DDS...

Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)

The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the Bouncy Castle Java library due to improper validation of a point within the elliptic curve. An...