CVE-2015-4299

Cisco Unified Web and E-Mail Interaction Manager 9.02 improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders via unspecified vectors, aka Bug ID CSCuo89046...

CVE-2015-4298

Cisco Unified Web and E-Mail Interaction Manager 9.02 and 11.01 improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056...

Apple iOS MSVDX Driver Denial of Service Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in the Apple iOS MSVDX driver allows remote users to build special video files that trick apps into parsing and crashing the system...

CVE-2015-5500

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4425

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

Code injection

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-4425

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

mysql: unspecified vulnerability related to Server:GIS (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS...

mysql: unspecified vulnerability related to Server:DDL (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL...

Command injection

Foreman before 1.9.0 allows remote authenticated users with the editusers permission to edit administrator users and change their passwords via unspecified vectors...

Authentication flaw

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-1867

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command...

Command injection

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command...

CVE-2015-2058

c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID...

CVE-2015-1867

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command...

Apache Subversion Sensitive Information Disclosure Vulnerability

Apache Subversion is a free/open source version control system. Apache Subversion modauthzsvn fails to properly handle special paths, allowing remote users to exploit a vulnerability to obtain sensitive information in hidden libraries...

CVE-2015-5622

Cross-site scripting XSS vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.ph...

Design/Logic Flaw

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...

Deserialization of untrusted data

IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...

CVE-2015-1488

CVE-2015-1488 affects Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1, via an unspecified action handler in the management console that allows remote authenticated users to read arbitrary files. The issue is addressed by upgrading SEPM to version 12.1-RU6-MP1 (per Symantec SY...