CVE-2015-5383

Summary: CVE-2015-5383 affects Roundcube Webmail 1.1.x before 1.1.2, where a remote attacker can read files from the config, temp, or logs directories to obtain sensitive information. The root cause is an information-disclosure path that allows unintended access to local files. The vulnerability ...

CVE-2015-8477

CVE-2015-8477 affects Redmine prior to 2.6.2, where a cross-site scripting (XSS) vulnerability exists in the rendering of flash messages. The underlying issue is improper sanitization of user-controlled content within message rendering, enabling an attacker to inject arbitrary HTML/JavaScript. Im...

CVE-2015-4704

CVE-2015-4704 is a directory traversal vulnerability in the WordPress plugin Download Zip Attachments 1.0. It allows remote attackers to read arbitrary files by supplying a .. in the File parameter to download.php, due to insufficient input/path validation. Affected software: WordPress Download Z...

CVE-2015-5469

CVE-2015-5469 affects the WordPress MDC YouTube Downloader plugin (v2.1.0). The vulnerability is a Local File Inclusion via the file parameter to includes/download.php, enabling an attacker to read arbitrary server files through an absolute path. Impact described in sources includes potential exp...

CVE-2015-5401

Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08Sles10 and 15.00.02.08Sles11 allow remote attackers to cause a denial of service database crash via a malformed CONFIG REQUEST message...

CVE-2015-1529

The CVE-2015-1529 entry corresponds to an integer overflow in Android’s soundtrigger subsystem, specifically in soundtrigger/ISoundTriggerHwService.cpp. This vulnerability allows a denial of service through unspecified vectors by triggering an overflow in processing within the SoundTrigger hardwa...

CVE-2015-4704

Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the File parameter to download.php...

CVE-2015-8089

The CVE-2015-8089 issue affects Huawei P7 devices (P7-L00/L05/L09) with specific firmware builds prior to P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851. The root cause is a GPU driver input validation failure that allows local attackers to read or write arbitrary kernel memory, enabling either ...

CVE-2015-5682

upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable...

CVE-2015-5468

Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter to includes/download.php...

CVE-2015-5241

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as...

CVE-2015-5241

Apache jUDDI versions 3.1.2–3.1.5 are affected by an open redirect vulnerability in the logout JSP page, allowing an attacker to redirect users to an arbitrary page after login/logout. The issue stems from the logout flow in the portlets-based UI (Pluto, jUDDI Portal, UDDI Portal, uddi-console). ...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor

Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerability Types: =================== Hidden User Backdoor...

CVE-2015-4070

CVE-2015-4070: Open redirect vulnerability in Wow Moodboard Lite plugin for WordPress (version 1.1.1.1) affecting the proxyimages function in wowproxy.php. Attackers can redirect users to arbitrary sites via the url parameter, enabling phishing. The provided documents confirm the vulnerability bu...

CVE-2015-4070

Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

CVE-2015-3998

phpwhois version 4.2.5 used in the WordPress adsense-click-fraud-monitoring plugin version 1.7.5 is documented to have a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script or HTML via the query parameter to whois.php. The linked reports confirm the affected componen...

SUSE SLED12 / SLES12 Security Update : libxslt (SUSE-SU-2017:1313-1)

This update for libxslt fixes the following issues : - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. -...

CVE-2015-9003

In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel...

CVE-2015-8996

In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel...

CVE-2015-8996

CVE-2015-8996 describes a time-of-check time-of-use race condition in a TrustZone QFPROM routine affecting Android builds from CAF using the Linux kernel. The issue centers on the TrustZone protected QFPROM path; the root cause is a TOCTOU race in the QFPROM routine, potentially enabling incorrec...