CVE-2015-0758

Cisco Unified MeetingPlace 8.6(1.9) is affected by CVE-2015-0758 via an XML External Entity (XXE) processing flaw that allows authenticated, remote attackers to read arbitrary files from the server. The vulnerability stems from improper handling of XML entities in the web-based user interface, as...

CVE-2015-3995

SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565...

DEBIAN-CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-2121

CVE-2015-2121 affects HP Network Virtualization for LoadRunner and Performance Center (versions 11.52 and 8.61). The root cause is failure to sanitize filenames in URLs handled by HttpServlet and NetworkEditorController, allowing remote attackers to read arbitrary files. This information-disclosu...

PT-2015-7904

Name of the Vulnerable Software and Affected Versions PostGIS versions prior to 2.1.3 PostGIS version 2.1.7 Description The PostGIS Raster support in PostGIS may give more privileges to users than an administrator is willing to grant, including reading files from the filesystem and opening...

CVE-2015-1155

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site...

UBUNTU-CVE-2015-0844

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted 1 campaign or 2 map file...

CVE-2015-1415

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

Code injection

Cisco Unified Call Manager CM 9.12.1000.28 does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439...

Sniff Sensitive Data From Interface or pcap: net-creds

Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification. Sniffs URLs visited POST loads sent HTTP form logins/passwords HTTP basic auth logins/passwords HTTP searches FTP logins/passwords IRC...

CVE-2015-0527

EMC Documentum xCelerated Management System xMS 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform xCP provisioning, which allows local users to obtain sensitive information by reading a file...

CVE-2015-0875

The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file...

CVE-2015-0875: Exposure of Sensitive Information to an Unauthorized Actor

The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file...

Design/Logic Flaw

The InputAccel Database IADB installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel IA SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file...

Mandriva Linux Security Advisory : python-django (MDVSA-2015:036)

Updated python-django packages fix security vulnerabilities : Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments CVE-2015-0219. Mikko Ohtamaa discovered that Django...

Debian DSA-3151-1 : python-django - security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-0219 Jedediah Smith reported that the WSGI environ in Django does not distinguish between headers...

PT-2015-5232

Name of the Vulnerable Software and Affected Versions Siemens Ruggedcom WIN51xx devices with firmware prior to SS4.4.4624.35 Siemens Ruggedcom WIN52xx devices with firmware prior to SS4.4.4624.35 Siemens Ruggedcom WIN70xx devices with firmware prior to BS4.4.4621.32 Siemens Ruggedcom WIN72xx...

CVE-2014-4499

The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file...

Design/Logic Flaw

The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file...

[SECURITY] [DSA 3134-1] sympa security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3134-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 20, 2015 http://www.debian.org/security/faq -...