CVE-2015-7968

SAP NetWeaver Application Server is affected by CVE-2015-7968 due to the nwbc_ext2int component, which allows XXE-based local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI. The root cause is improper XML entity handling in nwbc_ext2int, enabling access to local files. The vulnerability...

Medium: freetype

Issue Overview: FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c. CVE-2015-9381 FreeType before 2.6.1 has a buffer over-read in skipcomment in psaux/psobjs.c because psparserskipPStoken is mishandled in an FTNewMemoryFace operation. CVE-2015-9382...

Apache ActiveMQ 5.11.1 Directory Traversal / Shell Upload Exploit

This Metasploit module exploits a directory traversal vulnerability CVE-2015-1830 in Apache ActiveMQ versions 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default...

GHSA-738M-F33V-QC2R SMTP Injection in PHPMailer

Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts. Patches Fixed in 5.2.14 in this commit. Workarounds Manually strip line breaks from email addresses before passing...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.5 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Improper access control

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by a vulnerability with the IPv6 networking support (CVE-2015-2922)

Summary The following vulnerability in IPv6 has been addressed by IBM Integrated Management Module II IMM2. Vulnerability Details CVEID: CVE-2015-2922 DESCRIPTION: Linux Kernel, built with the IPv6 networking supportCONFIGIPV6, is vulnerable to a denial of service, caused by the improper handling...

CVE-2015-1583

creationtimestamp| type| source ---|---|--- 2020-03-02 19:23:15+00:00| seen| https://t.me/cibsecurity/10216...

CVE-2015-1583

ATutor LCMS 2.2 is affected by CSRF in two admin-facing endpoints (mods/_core/users/admins/create.php and mods/_core/users/create_user.php). The root cause is cross-site request forgery that allows an authenticated admin context to create either another administrator (super admin) or a new instru...

MS15-124: Cumulative Security Update for Internet Explorer (CVE-2015-6161) (3125869)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3125869 and/or a Registry key to prevent the host against CVE-2015-6161. It is, therefore, affected by Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass t...

Apache James Server Command Injection (CVE-2015-7611)

A command injection vulnerability exists in Apache James server. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary commands on the affected system...

CVE-2015-3006

creationtimestamp| type| source ---|---|--- 2020-02-29 02:33:18+00:00| seen| https://t.me/cibsecurity/10194...

CVE-2015-5361

creationtimestamp| type| source ---|---|--- 2020-02-29 02:33:17+00:00| seen| https://t.me/cibsecurity/10193...

CVE-2015-3006

CVE-2015-3006 applies to Juniper Junos OS on QFX3500 and QFX3600 switches. The described vulnerability is an entropy issue: during boot the device collects too few bytes from the RANDOM_INTERRUPT entropy source, which can lead to weak or duplicate SSH keys and self-signed SSL/TLS certificates. En...

CVE-2015-2992

Apache Struts before 2.3.20 has a cross-site scripting XSS vulnerability...

CVE-2015-2992

Apache Struts CVE-2015-2992 is an XSS vulnerability in Struts before 2.3.20, caused by improper validation of user input when JSP files are accessed directly. Exploitation could allow a remote attacker to run scripts in the victim’s browser and steal cookies. Affected products/versions include St...

CVE-2015-5686

creationtimestamp| type| source ---|---|--- 2020-02-27 07:58:27+00:00| seen| https://t.me/cibsecurity/10126...

CVE-2015-5686

Puppet Enterprise Console 3.x is affected by CSRF and clickjacking vulnerabilities leading to possible session hijacking or redirection of user input to untrusted sites. This CVE (CVE-2015-5686) is corroborated by multiple sources in connected documents (e.g., CNVD-2020-17190 and NVD entries) des...

CVE-2015-5201

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor aka RHEV-H 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows...

CVE-2015-5201

CVE-2015-5201 affects VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (RHEV-H) 6-6.x (before 6-6.7-20151117.0) and 7-7.x (before 7-7.2-20151119.0) as packaged before RHEV-H 3.5.6. The underlying issue occurs when VSDM runs with -spice disable-ticketing and a VM is suspended and t...