CVE-2015-0258

Collabtive up to version 2.0/2.1 had an avatar-upload input validation flaw in manageuser.php that could enable an authenticated user to upload crafted files (.php3/.php4/.php5/.phtml) and execute arbitrary code. Public advisories (USN-4590-1, DLA-2125-1) and Debian/Nessus entries describe fixes ...

CVE-2015-1387

...

CVE-2015-1387

CVE-2015-1387 is a reservation duplicate of CVE-2015-1454. Connected records confirm a MitM certificate-validation flaw in Blue Coat ProxyClient and Unified Agent: ProxyClient <3.3.3.3 and 3.4.x <3.4.4.10; Unified Agent

CVE-2015-5215

The default configuration of the Jinja templating engine used in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via template variables. NOTE: This may be a duplica...

CVE-2015-5215

CVE-2015-5215 affects the Identity Provider (IdP) server of Ipsilon, specifically versions 0.1.0 through 1.0.0, where the Jinja templating engine is not auto-escaped by default. The documented consequence is easier remote cross-site scripting (XSS) via template variables, tied to the IdP’s defaul...

CVE-2019-13966

In iTop through 2.6.0, an XSS payload can be delivered in certain fields such as icon of the XML file used to build the dashboard. This is similar to CVE-2015-6544 which is only about the dashboard title...

Security Bulletin: Vulnerability in IBM Java Runtime Version 6 affects IBM Cognos Business Viewpoint (CVE-2015-7575 )

Summary There is a vulnerability in IBM Runtime Environment Java Technology Edition, Version 6 that affects IBM Cognos Business Viewpoint. These issues were disclosed as part of the EXPEDITED Java specific SLOTH - Weak MD5 Signature Hash security advisory. Vulnerability Details CVEID: CVE-2015-75...

Security Bulletin: Vulnerability in IBM Java Runtime Version 6 affects IBM Cognos Business Viewpoint (CVE-2015-4872 )

Summary There is a vulnerability in IBM Runtime Environment Java Technology Edition, Version 6 that affects IBM Cognos Business Viewpoint. These issues were disclosed as part of the IBM Java SDK updates in October 2015. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified...

CVE-2015-6589

CVE-2015-6589 is a directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) affecting versions 7.0.0.0–7.0.0.32, 8.0.0.0–8.0.0.22, 9.0.0.0–9.0.0.18, and 9.1.0.0–9.1.0.8/9.1.0.9 (pre-patch). The issue arises from insufficient restrictions on file paths to json.ashx, allowing ...

CVE-2015-3309

The CVE-2015-3309 entry concerns Etherpad’s Minify.js (node/utils/Minify.js) with a directory traversal vulnerability in Etherpad versions 1.1.2 through 1.5.4. The root cause is an incomplete fix to CVE-2015-3297, allowing an attacker to read arbitrary files via a .. sequence in the path paramete...

Adobe Acrobat DC 2015 Security Update (APSB20-05) - Mac OS X

Adobe Acrobat DC 2015 is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Adobe Reader DC 2015 Security Update (APSB20-05) - Mac OS X

Adobe Reader DC Classic 2015 is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2015-7890

CVE-2015-7890 affects the Exynos Seiren Audio driver (esignated /dev/seiren) on Samsung Galaxy S6 Edge. The vulnerability is described as multiple buffer overflows in the esa_write function, leading to local memory corruption and potential denial of service; Project Zero notes it can enable kerne...

CVE-2015-5617

CVE-2015-5617 describes a SQL injection in Enorth Webpublisher CMS via /pub/m_pending_news/delete_pending_news.jsp. The parameter cbNewsId is read and used in a SQL DELETE built by PendingNewsBean.deletePendingNews, concatenating IDs into an IN clause without sufficient validation. A remote attac...

CVE-2015-7508

Heap-based buffer overflow in the bmpdecoderle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file...

CVE-2015-7508

Heap-based buffer overflow in the bmpdecoderle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file...

CVE-2015-7508

Libnsbmp 0.1.2 is vulnerable to a heap-based buffer overflow in bmp_decode_rle (libnsbmp.c). The last row of Run-Length Encoded data can overflow libnsbmp’s bitmap buffer, enabling DoS (crash) or possibly arbitrary code execution. The connected sources confirm the issue and cite a public exploit/...

CVE-2015-7508

Heap-based buffer overflow in the bmpdecoderle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with Predictive Customer Intelligence (CVE-2015-7450)

Summary WebSphere Application Server is shipped as a component of Predictive Customer Intelligence. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Vulnerability...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server that is shipped with IBM Predictive Customer Intelligence (CVE-2015-2017)

Summary WebSphere Application Server is shipped as a component of Predictive Customer Intelligence. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin HTTP response...