CVE-2015-4162

XML external entity XXE vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data...

CVE-2015-0211

mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtai...

Design/Logic Flaw

files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restriction...

CVE-2015-1493

Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...

CVE-2015-2269

Multiple cross-site scripting XSS vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 alt or 2 title attribute in an IMG element...

UBUNTU-CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

WellinTech KingSCADA < 3.1.2.13-EN KAEClientManager Console Remote Authentication Credential Disclosure

Binary data scadakingscadakaeclientmanager.nbin...

CVE-2015-0193

Cross-site scripting XSS vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL th...

CVE-2015-0754

Cisco Finesse 10.51 allows remote authenticated users to obtain sensitive information or cause a denial of service CPU and memory consumption via a crafted XML document, aka Bug ID CSCut95810...

Session fixation

The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818...

CVE-2015-3995

CVE-2015-3995 concerns SAP HANA DB 1.00.73.00.389160 (NewDB100_REL). A remote, authenticated user can read arbitrary files via an IMPORT FROM SQL statement due to an improper access control weakness. Onapsis’ advisory (linked to CVE-2015-3995) documents the vulnerability class as Improper Access ...

CVE-2015-2123

Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand access...

CVE-2015-2118

Unspecified vulnerability in the Secure Pull Print and Security Pull Print components in HP Access Control AC Software 12.x through 14.x before 14.1.2 allows remote authenticated users to obtain sensitive information via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand access...

CVE-2015-2120

Unspecified vulnerability in HP SiteScope 11.1x before 11.13, 11.2x before 11.24.391, and 11.3x before 11.30.521 allows remote authenticated users to gain privileges via unknown vectors, aka ZDI-CAN-2567...

Code injection

Unspecified vulnerability in HP SiteScope 11.1x before 11.13, 11.2x before 11.24.391, and 11.3x before 11.30.521 allows remote authenticated users to gain privileges via unknown vectors, aka ZDI-CAN-2567...

Design/Logic Flaw

The administrative web interface in Cisco Hosted Collaboration Solution HCS 10.61 and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786...

CVE-2015-0916

SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the localgraphid parameter, a different vulnerability than CVE-2007-6035...

Moodle Private File Upload Vulnerability

Moodle is an open source web-based teaching and learning application. A security vulnerability exists in Moodle versions prior to 2.6.11, 2.7.8, 2.8.6, and 2.9 that allows remotely authenticated users with the 'moodle/user:manageownfiles' feature to upload private files via Web Services...

Multiple Vulnerabilities in ISPConfig

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular hosting control panel ISPConfig. The vulnerabilities can be exploited to execute arbitrary SQL commands in application database, perform a CSRF attack and gain complete control over the web application. 1 SQL...