UBUNTU-CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

CVE-2015-5531 is a directory traversal vulnerability in Elasticsearch affecting versions 1.0.0 through 1.6.0, allowing a remote attacker to read arbitrary files via vectors related to the snapshot API. Multiple connected sources document the issue and reproduce/exploit paths (e.g., elasticsearch ...

Xxe

The Text Formats component in Apple OS X before 10.10.5, as used in TextEdit, allows remote attackers to read arbitrary files via a text file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-3784

CVE-2015-3784 affects Apple’s Office Viewer in iOS versions before 8.4.1 and OS X versions before 10.10.5. The issue arises from an XML External Entity (XXE) vulnerability where an external entity declaration, combined with an entity reference, enables a remote attacker to read arbitrary files vi...

CVE-2015-3762

The Text Formats component in Apple OS X before 10.10.5, as used in TextEdit, allows remote attackers to read arbitrary files via a text file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-4481

CVE-2015-4481 is a concrete vulnerability in Mozilla Maintenance Service on Windows where a hard-link race allows arbitrary file overwriting, enabling local privilege escalation. Public documentation across connected sources confirms the issue affects Windows Firefox/maintenance service and was a...

Symantec Endpoint Protection Manager < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)

The version of Symantec Endpoint Protection Manager SEPM running on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the password reset functionality that allows a remote attacker, using a crafted password reset action, to...

CVE-2015-1331

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

Design/Logic Flaw

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

CVE-2015-1331

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

Pimcore CMS 'dir' Parameter Directory Traversal Vulnerability

Pimcore CMS is a software developer pimcore developed a set of open source for the creation and management of Web applications content management system CMS. A directory traversal vulnerability exists in Pimcore CMS. A remote attacker can exploit this vulnerability by sending a specially crafted...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

Koha Directory Traversal Vulnerability

Koha is the first open source library automation system. Koha suffers from a directory traversal vulnerability that could be exploited by an attacker to read arbitrary files...

CVE-2015-4495

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the...

CVE-2015-4495

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the...

Important: Red Hat Security Advisory: firefox security update

Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Mozilla: Same origin violation and local file stealing via PDF reader (MFSA 2015-78)

A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer PDF.js. An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files including...

Cisco AnyConnect Secure Mobility Client < 3.1.8009.0 / 4.0.x < 4.0.2052.0 / 4.1.x < 4.1.28.0 Multiple Vulnerabilities

The Cisco AnyConnect Secure Mobility Client installed on the remote host is a version prior to 3.1.8009.0, or is version 4.0.x prior to 4.0.2052.0, or version 4.1.x prior to 4.1.28.0. It is, therefore, affected by the following vulnerabilities : - A flaw exists due to not sanitizing the input of...