CVE-2015-2060

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash...

CVE-2015-1855

CVE-2015-1855 affects Ruby’s OpenSSL hostname matching: the OpenSSL extension fails to validate hostnames, allowing server spoofing. Affected: Ruby/OpenSSL before 2.0.0 patchlevel 645; 2.1.x before 2.1.6; 2.2.x before 2.2.2. Root cause: permissive hostname matching (wildcards, IDNA, case, non‑ASC...

CVE-2015-3406

CVE-2015-3406 affects the Perl module Module::Signature prior to 0.74, where the PGP signature parsing can cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors. The vulnerability can lead to partial integrity impact without confidentiality or ...

CVE-2015-3406

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors...

CVE-2015-9539

The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fscontactform1welcome XSS...

CVE-2015-9538

The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection...

CVE-2015-9537

The CVE-2015-9537 entry concerns the WordPress NextGEN Gallery plugin prior to version 2.1.10, which contains multiple XSS vulnerabilities. The affected component is the NextGEN Gallery WordPress plugin; the root cause is insufficient sanitization/validation of user-supplied input in several fiel...

CVE-2015-9538

The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection...

CVE-2015-9538

The CVE-2015-9538 entry applies to the WordPress NextGEN Gallery plugin prior to version 2.1.15. The flaw is a directory traversal vulnerability in path selection ("../"), caused by insufficient filtering of path components, which could allow access to locations outside a restricted directory. Af...

CVE-2015-9539

The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fscontactform1welcome XSS...

CVE-2015-9539

The CVE-2015-9539 entry concerns the WordPress plugin Fast Secure Contact Form. Affects versions prior to 4.0.38, where the fs_contact_form1[welcome] parameter is vulnerable to cross-site scripting (XSS). Root cause is insufficient input validation/escaping in the form handling, enabling attacker...

CVE-2015-7831

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used...

CVE-2015-6495

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles...

CVE-2015-4457

Multiple cross-site scripting XSS vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors...

CVE-2015-4457

CVE-2015-4457 describes multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI prior to version 5.4.3. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The available references consistently state XSS as the impact,...

CVE-2015-6495

This CVE concerns Cloudera Manager prior to version 5.4.6, where the Diagnostic Support Bundles could disclose sensitive information. Multiple sources (NVD, Red Hat, CNVD, CVE lists) confirm an information-disclosure vulnerability affected Cloudera Manager before 5.4.6. Impact centers on confiden...

CVE-2015-6495

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles...

CVE-2015-7831

CVE-2015-7831 affects Cloudera Hue with privilege escalation for a read-only user when CDH 5.x before 5.4.9 is used. The NVD entry documents the vulnerability with CVSS 2.0/3.1 scores (base 6.5 and 8.8, respectively) and an attack path described as network-based with low attack complexity and no ...

DEBIAN-CVE-2015-1396

A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196...

CVE-2015-1396

A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196...