PT-2015-6655 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 5.2-5565 Update 1 Description: The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the...

PT-2015-6092 · Unknown · Thermostat

Name of the Vulnerable Software and Affected Versions: Thermostat versions prior to 2.0.0 Description: The issue allows local users to obtain user credentials by reading the web.xml configuration file due to world-readable permissions. Recommendations: For versions prior to 2.0.0, update to versi...

PT-2015-6385 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.0.5 Description: The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted...

WordPress eShop Magic Plugin <= 0.1 - Local File Inclusion

This plugin is prone to eshop-magic/download.php file parameter traversal arbitrary file access vulnerability. It allows attackers to disclose sensitive information. Solution Update the plugin...

PT-2015-6336 · Dave Coffin +2 · Dcraw +2

Name of the Vulnerable Software and Affected Versions: dcraw versions 7.00 and earlier Description: The issue is related to an integer overflow in the ljpeg start function, which can be triggered by a crafted image. This overflow is associated with the len variable and can cause a denial of servi...

KLA10571 Denial of service vulnerability in Foxit products

An unspecified vulnerability was found in Foxit products. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed GIF in PDF file or vectors related to digital signatures. Original advisories Foxit bulleti...

WordPress Tune Library Plugin 1.5.4 - SQL Injection Vulnerability

Exploit for php platform in category web applications ======================================================================= title: SQL Injection product: WordPress Tune Library Plugin vulnerable version: 1.5.4 and probably below fixed version: 1.5.5 CVE number: CVE-2015-3314 impact: CVSS Base...

KLA10541 Multiple vulnerabilities in Juniper Junos

Multiple serious vulnerabilities have been found in Juniper Junos. Malicious users can exploit these vulnerabilities to gainprivileges, execute arbitrary code orspoof user interface. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via unspecified vectors...

ArubaOS Remote Access Point (RAP) Command Injection (ARUBA-PSA-2015-004)

Aruba has identified a problem with the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:arubanetworks:arubaos"; if description...

PT-2015-5893 · Arj +1 · Open-Source Arj Archiver +1

Name of the Vulnerable Software and Affected Versions: Open-source ARJ archiver version 3.10.22 Description: A buffer overflow issue in the Open-source ARJ archiver allows remote attackers to cause a denial of service, potentially leading to a crash, or possibly execute arbitrary code. This can b...

KLA10536 Multiple vulnerabilities in Citrix NetScaler

Multiple serious vulnerabilities have been found in Citrix NetScaler. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code and conduct XSS attack. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed...

KLA10527 Multiple vulnerabilities in different versions of Xen

Multiple serious vulnerabilities have been found in Xen. Malicious users can exploit these vulnerabilities to cause denial of service or bypass security restrictions. Below is a complete list of vulnerabilities 1. Unknown vulnerability can be exploited remotely via a logger or domctl manipulation...

KLA10517 Privilege escalation in Foxit Reader

Search path vulnerability was found in Foxit Reader Cloud plugin. By exploiting this vulnerability malicious users gain privileges. This vulnerability can be exploited locally via files manipulation. Original advisories Foxit bulletins Exploitation Public exploits exist for this vulnerability...

KLA10498 Denial of service vulnerabilities in tcpdump

Multiple serious vulnerabilities have been found in tcpdump. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities 1. An unknown vulnerability can be exploited remotely via a specially designed packets and other unknown vectors; ...

KLA10497 Security bypass vulnerability in IBM Rational ClearQuest

Cross site reference forgery was found in IBM Rational ClearQuest. By exploiting this vulnerability malicious users can bypass security restrictions. This vulnerability can be exploited remotely via a auth hijack. Original advisories - Related products IBM-Rational-ClearQuest CVE list CVE-2014-89...

KLA10502 Multiple vulnerabilities in BACnet OPC Server

Multiple critical vulnerabilities have been found in BACnet OPC Server. Malicious users can exploit these vulnerabilities to execute arbitrary files and read&write local database. Below is a complete list of vulnerabilities 1. An unknwon vulnerabilities can be exploited remotely via unknown vecto...

KLA10480 Security bypass in Linux Kernel

Race condition was found in Linux Kernel. By exploiting this vulnerability malicious users bypass security restrictions. This vulnerability can be exploited locally via manipulating with handlebytes value. Original advisories - Related products Linux-Kernel CVE list CVE-2015-1420 warning Solution...

KLA10518 Denial of service vulnerabilities in Wireshark

Integer overflows and other unspecified vulnerabilities were found in Wireshark. By exploiting these vulnerabilities malicious users can cause denial of service. These vulnerabilities can be exploited remotely via a specially designed packet. Original advisories Wireshark advisories Related...

PT-2015-1513

Name of the Vulnerable Software and Affected Versions Firmware variant PROFINET IO for EN100 Ethernet module versions prior to V1.04.01 Firmware variant Modbus TCP for EN100 Ethernet module versions prior to V1.11.00 Firmware variant DNP3 TCP for EN100 Ethernet module versions prior to V1.03...

PT-2015-5569 · D Link · Dcs-931L

Name of the Vulnerable Software and Affected Versions: D-Link DCS-931L versions 1.04 and earlier Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, due to an unrestricted file upload vulnerability. Recommendations:...