CVE-2015-1861

CVE-2015-1861 entry is rejected/not used and does not represent an active vulnerability entry.

CVE-2015-2784

The CVE-2015-2784 entry concerns the papercrop gem for Ruby on Rails. Affected software is the papercrop gem before version 0.3.0; the root cause is improper handling of crop input. Impacted systems may face security issues due to unvalidated or mishandled crop data, with public sources indicatin...

Path traversal

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

CVE-2015-6907

...

CVE-2015-6907

CVE-2015-6907 is rejected/not used per initial description.

CVE-2015-1809

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query...

CVE-2015-1811

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document...

CVE-2015-1811

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document...

CVE-2015-6591

The CVE-2015-6591 entry concerns Free Reprintables ArticleFR 3.0.7 and earlier. It affects the web application path application/templates/amelia/loadjs.php, where the s parameter is used to read files via file_get_contents without proper validation, enabling local arbitrary file read by a non-aut...

CVE-2015-1811

Jenkins XXE: XML External Entity handling flaw in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows reading arbitrary XML files via crafted XML documents. Root cause: improper XML processing. Affected products/versions are Jenkins core prior to 1.600 and LTS prior to 1.596.1. Remediati...

CVE-2015-1811

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document...

CVE-2015-1809

XML external entity XXE vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query...

CVE-2015-1809

CVE-2015-1809 describes an XML External Entity (XXE) vulnerability in CloudBees Jenkins prior to 1.600 and in LTS releases prior to 1.596.1. The vulnerability arises from Jenkins' XPath/XML handling, allowing a remote attacker with read access to read arbitrary XML files on the Jenkins server. Af...

CVE-2015-5230

The DNS packet parsing/generation code in PowerDNS aka pdns Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service crash via crafted query packets...

CVE-2015-6497

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

CVE-2015-5071

CVE-2015-5071 affects BMC Remedy AR System: AR System Mid Tier prior to 9.0 SP1 in AR Reporting can allow remote authenticated users to navigate to arbitrary files via the __report parameter of the BIRT Viewer servlet. The vulnerability has been confirmed in BMC Remedy AR 8.1 and 9.0 (per errata)...

CVE-2015-5072

The CVE-2015-5072 entry concerns BMC Remedy AR System Server’s BIRT Engine Mid Tier prior to 9.0 SP1, where the BIRT Engine servlet could be exploited by remote authenticated users to navigate to arbitrary local files via the __imageid parameter. The issue is caused by a file inclusion/control pa...

CVE-2015-6497

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

CVE-2015-6497

The CVE-2015-6497 flaw affects Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, where unvalidated data passed in the SOAP API’s productData parameter to index.php/api/v2_soap enables remote authenticated attackers to execute arbitrary PHP code. The root c...

CVE-2015-5230

CVE-2015-5230 affects PowerDNS Authoritative Server 3.4.x up to before 3.4.6. The DNS packet parsing/generation code can crash the server on crafted query packets, enabling a remote DoS. Upgrading to 3.4.6 or later (per Fedora advisories and vendor fix) is the indicated remediation. No exploitati...