CVE-2015-7726

The CVE-2015-7726 entry concerns a cross-site scripting (XSS) vulnerability in SAP HANA DB’s Web-based Development Workbench, specifically in the role deletion function. Affected software is SAP HANA DB 1.00.091.00.1418659308, where remote authenticated users can inject arbitrary web script or HT...

CVE-2015-7727

Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 NewDB100REL allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the 1 trace configuration page or 2 getSqlTraceConfiguration function, aka SAP...

CVE-2015-5443

The CVE-2015-5443 entry concerns HP 3PAR Service Processor SPOCC, where remote authenticated users could obtain sensitive information. Affected SPOCC versions are SP 4.2.0.GA-29 (GA), SP 4.3.0.GA-17 (GA), and SP 4.3.0-GA-24 (MU1). The vulnerability is described as an information disclosure with u...

Multiple Vulnerabilities in the Western Digital Arkeia arkeiad Daemon

Western Digital Arkeia is a network backup and recovery solution from Western Digital. A security vulnerability exists in the arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia versions 11.0.12 and earlier. A remote attacker could exploit this vulnerability by sending a series of...

CVE-2015-7765

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password...

CVE-2015-5641

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5024

IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors...

CVE-2015-4964

IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTHTOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process...

CVE-2015-4967

SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 throu...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-2016

CVE-2015-2016 (IBM QRadar SIEM) describes a shell command injection vulnerability that can let an admin-authenticated user execute commands on the server as root. Affected products/versions include IBM QRadar SIEM 7.2.x and 7.1 MR2 with patches up to 11 IF02 or 7.2.5 Patch 4; IBM’s bulletin notes...

CVE-2015-0142

IBM OpenPages GRC Platform (versions 6.2–7.1) is affected by CVE-2015-0142 due to insufficient access checks for the System Administration Mode function, allowing remote authenticated users to transition to maintenance mode and trigger a data-storage outage. The vulnerability affects 6.2 before I...

CVE-2015-5645

ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...

Code injection

Cisco Email Security Appliance ESA 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service file-descriptor consumption and device reload via crafted HTTP requests, aka Bug ID CSCuw32211...

CVE-2015-5711

TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request...

CVE-2015-5435

Unspecified vulnerability in HP Integrated Lights-Out iLO firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vectors...

CVE-2015-6470

Resource Data Management’s Data Manager prior to version 2.2 is affected by a privilege-escalation vulnerability (CWE-269) that allows a valid authenticated user to change passwords for other users, including administrators, via unspecified vectors. Public records indicate remote access and passw...

CVE-2015-2915

CVE-2015-2915 affects Securifi Almond devices: firmware before AL1-R201EXP10-L304-W34 and Almond-2015 before AL2-R088M use a default admin password, enabling a local intranet attacker to gain web-management access. The vulnerability is due to default credentials that allow authentication without ...

CVE-2015-6547

Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 are affected by CVE-2015-6547, a Command Injection at Boot Time Elevation of Privilege flaw in the management console. An authenticated remote attacker can inject commands via the hostname configuration, executing them w...

CVE-2015-6300

CVE-2015-6300 affects Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15). A vulnerability in the SSH feature allows remote authenticated users to cause a denial of service by issuing crafted commands via CLI or GUI, triggering an SSH screen process crash (Bug ID CSCuw24694). The C...