CVE-2015-4045

The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-4054

PgBouncer before 1.5.5 allows remote attackers to cause a denial of service NULL pointer dereference and crash by sending a password packet before a startup packet...

CVE-2015-8477

Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...

CVE-2015-6817

CVE-2015-6817 affects PgBouncer 1.6.x before 1.6.1. The vulnerability allows a remote attacker to gain login access as auth_user via an unknown username when configured with the auth_user feature. Public references in multiple databases (NVD, OSV, CNVD, Debian tracker, Gentoo GLSA) corroborate th...

CVE-2015-4455

The Aviary Image Editor Add-on For Gravity Forms plugin (version 3.0 beta ) for WordPress is vulnerable to an unrestricted file upload in includes/upload.php. The root cause is a lack of authentication checks and file type validation, allowing unauthenticated remote attackers to upload files with...

CVE-2015-4054

PgBouncer (PostgreSQL connection pooler) is vulnerable in versions prior to 1.5.5. The issue arises when a password packet is sent before a startup packet, enabling remote denial of service via a NULL pointer dereference and crash. The available connected documents confirm this behavior and indic...

CVE-2015-5609

The CVE-2015-5609 entry describes an absolute path traversal in the WordPress Image Export plugin 1.1, allowing remote attackers to read and delete arbitrary files via a full pathname passed to download.php. Affected component is the WordPress Image Export plugin (version 1.1); root cause is a pa...

CVE-2015-6586

The CVE-2015-6586 issue affects Huawei WLAN AC6005, AC6605, and ACU2 devices with software prior to V200R006C00SPC100. The mDNS module fails to restrict unicast query processing to the link-local network, enabling remote attackers to obtain sensitive information through information disclosure. Th...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

CVE-2015-4045

The CVE-2015-4045 entry concerns AlienVault OSSIM (asset discovery scanner) with a vulnerable sudoers configuration that permits local privilege escalation via a crafted nmap script prior to 5.0.1. Affected component: sudoers handling in the asset discovery scanner; root cause: crafted nmap scrip...

CVE-2015-5381

Summary: The CVE-2015-5381 entry affects Roundcube Webmail 1.1.x before 1.1.2, where a cross-site scripting (XSS) vulnerability exists in the file program/include/rcmail.php . A remote attacker can exploit this by supplying a crafted payload to the _mbox parameter at the default URI, enabling inj...

CVE-2015-4045

The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script...

CVE-2015-5401

CVE-2015-5401 affects Teradata Gateway and TD Express. A remote attacker can cause a denial of service (database crash) by sending a malformed CONFIG REQUEST message. Affected versions: Teradata Gateway prior to 15.00.03.02-1 and 15.10.x prior to 15.10.00.01-1; TD Express prior to 15.00.02.08_Sle...

CVE-2015-4046

CVE-2015-4046 affects the asset discovery scanner in AlienVault OSSIM prior to version 5.0.1 . The vulnerability resides in the assets[] parameter to netscan/do_scan.php , allowing remote authenticated users to execute arbitrary commands. This constitutes a remote code execution risk with network...

CVE-2015-5382

The CVE-2015-5382 vulnerability affects Roundcube Webmail prior to 1.0.6 and 1.1.x prior to 1.1.2. Affected component: program/steps/addressbook/photo.inc. Root cause: information disclosure via the _alt parameter when uploading a vCard, allowing remote authenticated users to read arbitrary files...

CVE-2015-5682

The CVE concerns the WordPress Powerplay Gallery plugin, version 3.3, where upload.php allows remote attackers to create arbitrary directories through vectors related to the targetDir parameter. This is a remote, unauthenticated vulnerability that enables directory creation, potentially aiding fu...

CVE-2015-5468

A directory traversal vulnerability exists in the WP e-Commerce Shop Styling plugin for WordPress (versions before 2.6 ). The root cause is an improper limitation of a pathname within ./wp-ecommerce-shop-styling/includes/download.php, where user input from the filename parameter is not properly s...

CVE-2015-8477

Cross-site scripting XSS vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering...