CVE-2015-1396

GNU patch before 2.7.4 is vulnerable to a directory-traversal via a symlink attack in a patch file, allowing remote write of arbitrary files. Root cause: incomplete fix for CVE-2015-1196. Affected: GNU patch (up to 2.7.3). Remediation: upgrade to 2.7.4 or later; no further details provided in the...

CVE-2015-7810

libbluray MountManager class has a time-of-check time-of-use TOCTOU race when expanding JAR files...

CVE-2015-7810

CVE-2015-7810 affects the libbluray MountManager class, where a time-of-check time-of-use (TOCTOU) race can occur during the expansion of JAR files. The available connected material confirms the vulnerable component (MountManager in libbluray) and the underlying issue (TOCTOU race condition) but ...

CVE-2015-1780

CVE-2015-1780 affects oVirt (notably ovirt-engine) where users holding MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center. The connected Nessus entries corroborate an unpatched exposure for this vulnerability, but the provided documents do not include patch versi...

CVE-2015-5694

Technical details for CVE-2015-5694 are not publicly available in the provided documents. Monitor for updates.

CVE-2015-3140

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567...

CVE-2015-3140

CVE-2015-3140 affects Synametrics products: SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567, vulnerable to cross-site request forgery (CSRF). Root cause: CSRF in multiple web app components allowing attacker to trigger actions in an authenticated use...

CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...

CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...

CVE-2015-2793

CVE-2015-2793 is an XSS vulnerability in ikiwiki prior to 3.20150329, triggered via the openid_identifier parameter in the verify action to ikiwiki.cgi. The flaw is located in templates/openid-selector.tmpl and allows remote attackers to inject arbitrary web script or HTML. Affected component is ...

CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...

CVE-2015-3166

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, a...

CVE-2015-3167

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack...

CVE-2015-3166

CVE-2015-3166 affects PostgreSQL; the snprintf implementation fails to properly handle errors from system calls, which can lead to information disclosure or other unspecified impact via out-of-memory scenarios. Affected versions include PostgreSQL releases before 9.0.20, 9.1.x before 9.1.16, 9.2....

CVE-2015-3167

Summary: CVE-2015-3167 affects PostgreSQL contrib/pgcrypto; when an incorrect key is used, it returns different error messages, enabling possible key exposure via brute force. The issue affects multiple branches and versions prior to fixed releases. Root cause: inconsistent error responses in pgc...

CVE-2015-1607

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service invalid read operation via a crafted keyring file, related to sign extensions and "memcpy with overlappi...

DEBIAN-CVE-2015-1607

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service invalid read operation via a crafted keyring file, related to sign extensions and "memcpy with overlappi...

CVE-2015-1607

Technical details of CVE-2015-1607 are not provided in the connected documents. The Initial Description mentions GNUPG but lacks vendor/product/version specifics beyond that. Monitor for updates.

CVE-2015-1607

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service invalid read operation via a crafted keyring file, related to sign extensions and "memcpy with overlappi...

CVE-2015-1606

Technical details for CVE-2015-1606 are not publicly provided in the connected documents. The batch includes unrelated CVEs and generic notes, but no vendor/product/version/root-cause/impact specific to this CVE. Monitor for official updates and disclosures.