DEBIAN-CVE-2015-8467

The samldbcheckuseraccountcontrolacl function in dsdb/samdb/ldbmodules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass...

SAP Mobile Platform SysAdminWebTool servlets elevation of privilege vulnerability

SAP Mobile Platform is a set of mobile application development platform from SAP. A security vulnerability in the SysAdminWebTool servlets of SAP Mobile Platform allows remote attackers to bypass authentication and gain access to sensitive information and privileges...

Design/Logic Flaw

EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption SEE before 11.1.0 allows remote authenticated users to discover credentials by triggering a memory dump...

Cisco EPC3928 devices with EDVA security mechanism bypass vulnerability

The Cisco EPC3928 devices is a wireless router product from Cisco USA. A security mechanism bypass vulnerability exists in Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11,5.7.1. Allows remote attackers to pass expected authentication requirements and perform unspecified administrative functions vi...

CVE-2015-8570

CVE-2015-8570 involves Lepide Active Directory Self Service. The vulnerability allows remote authenticated domain users to change arbitrary domain passwords via crafted requests during the password reset process, due to a flaw in how the reset functionality is processed. Multiple sources (NVD ent...

UBUNTU-CVE-2015-5343

Integer overflow in util.c in moddavsvn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service subversion server crash or memory consumption and possibly execute arbitrary code via a skel-encoded request body, which...

CVE-2015-6422

The CVE-2015-6422 entry concerns Cisco Unified Communications Domain Manager (CUCDM) self-service application in version 10.6(1). The vulnerability arises from improper handling of malformed requests by the self-service component, allowing an authenticated remote user to cause a denial of service...

CVE-2015-6419

Cisco FireSIGHT Management Center (versions 4.10.3, 5.2.0, 5.3.0, 5.3.1, 5.4.0) contains an information-disclosure vulnerability in the GET request handling. An authenticated, remote attacker can trigger the flaw by sending crafted GET requests due to improper sanitation of user-supplied input, p...

CVE-2015-3628

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6,...

McAfee Enterprise Security Manager Security Mechanism Bypass Vulnerability

McAfee Enterprise Security ManagerA security management product from the U.S.-based McAfee that calculates real-time baseline activity on all information collected and provides prioritized alerts on potential threats before they occur. A security mechanism bypass vulnerability exists in McAfee...

PYSEC-2015-41

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider SP owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name...

ZTE ZXHN H108N R1A Privilege Bypass Vulnerability

The ZTE ZXHN H108N R1A is a wireless router product from China's ZTE Corporation. A security vulnerability exists in ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.hPE that allows remote attackers to authenticate using a pre-existing account and perform unauthorized operations by manipulating a paramete...

CVE-2015-7774

PC-EGG pWebManager is affected by OS command injection (CWE-78) that can be triggered by a user with editor permissions. Vulnerable versions include pWebManager before 3.3.10 and pWebManager for PHP4 before 2.2.2. A remote authenticated editor can execute arbitrary OS commands on the server. Conn...

CVE-2015-2698

The iakerbgssexportseccontext function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 aka krb5 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service memory corruption or possibly have unspecified other impact by...

CVE-2015-6363

Cisco FireSight Management Center Web Framework Cross-Site Scripting Vulnerability (CVE-2015-6363) affects MC 5.4.1.4 and 6.0.1. The root cause is improper sanitization of parameter values in the web framework, allowing an authenticated remote attacker to inject arbitrary script/HTML via unspecif...

CVE-2015-8003

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads...

CVE-2015-8001

The chunked upload API ApiUpload in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size...

CVE-2015-8001

The chunked upload API ApiUpload in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size...

UBUNTU-CVE-2015-8002

The chunked upload API ApiUpload in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service disk consumption via a file upload using one byte chunks...

CVE-2015-8003

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads...