CVE-2015-20107

The CVE-2015-20107 issue affects CPython’s mailcap module through Python 3.10.8 (and back-ported fixes to 3.7–3.9). Root cause: mailcap.findmatch does not escape system-mailcap commands, enabling shell-command injection when untrusted input is used (e.g., via unvalidated filenames/arguments). Doc...

CVE-2015-20107

In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input if they lack validation of user-provided...

Time-Based One-Time Password Algorithm (TOPT) Replay Attack

devise-two-factor is vulnerable to time-based one-time password algorithm TOPT replay attacks. A remote attacker is able to reuse the one-time-password immediately trailing the interval in order to gain access to the victim's account given that the attacker already knows the victim's credentials...

Design/Logic Flaw

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

UBUNTU-CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cisco MDS Switches and Directors.

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cisco Switches and Directors has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0291 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By connecting to a...

CVE-2015-3276 affecting package openldap for versions less than 2.4.57-5

CVE-2015-3276 affecting package openldap for versions less than 2.4.57-5. A patched version of the package is available...

CVE-2015-7697 affecting package unzip for versions less than 6.0-19

CVE-2015-7697 affecting package unzip for versions less than 6.0-19. A patched version of the package is available...

CVE-2015-7696 affecting package unzip for versions less than 6.0-19

CVE-2015-7696 affecting package unzip for versions less than 6.0-19. A patched version of the package is available...

CVE-2015-2987 affecting package ed for versions less than 1.14.2-9

CVE-2015-2987 affecting package ed for versions less than 1.14.2-9. A patched version of the package is available...

CVE-2015-4646 affecting package squashfs-tools for versions less than 4.5-1

CVE-2015-4646 affecting package squashfs-tools for versions less than 4.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2015-8863 affecting package jq for versions less than 1.5-6

CVE-2015-8863 affecting package jq for versions less than 1.5-6. A patched version of the package is available...

CVE-2015-4645 affecting package squashfs-tools for versions less than 4.5-1

CVE-2015-4645 affecting package squashfs-tools for versions less than 4.5-1. An upgraded version of the package is available that resolves this issue...

Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

GHSA-JM35-H8Q2-73MP Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

CVE-2015-3565

The IBM Security Bulletin links CVE-2015-3565 to a net-snmp vulnerability used by IBM Flex System Manager (FSM). Net-SNMP can crash snmptrapd when handling SNMP traps with a NULL type if started with -OQ, leading to a denial-of-service. Affected FSM versions include Flex System Manager 1.1.x.x th...

CVE-2015-3298

creationtimestamp| type| source ---|---|--- 2022-03-30 07:11:53+00:00| seen| https://t.me/cibsecurity/39786 2026-07-07 08:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq277vbix22o...

CVE-2015-3298

Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated...